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(54) Credit cant system and method 

(57) A credit card system is provided which has the 
added feature of providing additional limited use credit 
card numbers and/or cards. These numbers and/or 
cards can be used for a single or limited use transaction, 
thereby reducing the potential for fraudulent reuse of 
these numbers and/or cards. The credit card system 
finds application to "card remote" transactions such as 
by phone or Internet. Additionally, when a single use or 
limited use credit card is used for "card present" trans- 



actions, so called "skimming" fraud is eliminated. Vari- 
ous other features enhance the credit card system, 
which will allow secure trade without the use of elabo- 
rate encryption techniques. Methods for limiting, distrib- 
uting and using a limited use card number, controlling 
the validity of a limited use credit card number, conduct- 
ing a limited use credit card number transaction and pro- 
vkitng remote access devices for accessing a limited 
use credit card number are also provided. 
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Descripti n 

FIELD OF THE INVENTION 

5 [0001] This invention relates to a credit card system and method, and more particularly, to a credit card system and 
method offering reduced potential of credit card number misuse. 

RELATED ART 

'fO [0002] The development of retail electronic commerce has been relatively slow in spite of the perceived demand for 
such trade. The single greatest deien^ent to the expansion of retail electronic commerce is percewed to be the potential 
for fraud. This potential for fraud has been a major concern for the credit card companies and financial institutions as 
well as the customers and the providers of the goods and services. 

{0003] The former are corKjemed at>out fraud because essentially the financia] Institutions have to bear the initial 
15 cost of the fraud. Additionally, the credit card companies have an efficient credit card system which is working well for 
face to face transactions, i.e., Dcard presentD transactions where the credit card is physically presented to a trader 
and the trader can obtain the credit card number, compare signatures and in many cases photographs before accepting 
a particular credK card. 

[0004] The latter are equally concerned about fraud being well aware ^at ultimately the user must pay for ^ fraud. 
20 However, there are particular personal concerns for the consumer in that the fraudulent use of the credit card by misuse 
of the credit card number by a third party may not become apparent for some time. This can happen even if the card 
is still in his or her possession. Further, when fraud does occur the consumer has the task of persuading the credit 
card provider that fraud by another did indeed occur. 

[0005] There is also the additional fear of being overcharged on a credit card. There are thus particular risks for 

25 those credit card holders who have relatively high spending limits, in that if fi-aud should occur, it may be some con- 
siderable time before it is detected. One particular form of fraud referred to as "skimming" is particularly difficult to 
control. What happens is the card holder proffers his or her card at an establishment to make a transaction, the relevant 
information is electronically and/or physicaiiy copied from the card and the card is subsequently reproduced. This can 
be a problem with travelers particularly during an extensive period of travel as the fraudulent card may turn up in other 

30 places and it may be some considerable time before the fraud is detected. 

[0008] For remote credit card use. the credit card holder has to provide details of name, master credit card number, 
expiration date and address and often many other pieces of information for verification; the storing and updating of the 
information is expensive but necessary. This of itself is a considerable security risk as anyl>ody will appreciate that this 
information could be used to fraudulently charge goods and services to the card holder's credit card account. Such 

35 fraudulent use is not limited to those people to whom the credit card information has been given legitimately, but extends 
to anybody who can illegitimately obtain such details. A major problem in relation to this form of fraud is that the credit 
card may still be In the possession of the legitimate holder as these fraudulent transactions are taking place. This is 
often referred to as "compromised numbers" fraud. Indeed all this fraud needs is one dishonest staff member, for 
example in a shop, hotel or restaurant, to record the credit card number. It is thus not the same as card theft. 

40 [0007] The current approaches to the limiting of credit card fraud are dependent on the theft of a card being reported 
and elaborate verification systems whereby altered patterns of use initiate some inquiry from the credit card company. 
Many users of credit cards have no doubt received telephone calls, when their use of the card has been excepttonai, 
or otherwise unusual in the eyes of the organization providing the verification servrces. 

[0008] Thus, there have been many developments in an effort to overcome this fundamental problem of fraud, both 
45 In the general area of fraud for ordinary use of credit cards and for the particular problems associated with such remote 
use. 

[0009] One of the developments is the provision of smart cards which are credit card devices containing embedded 
electronic circuitry that can either store infonmation or perform computations. Generally speaking they contribute to 
credft card security systems by using some encryption system. A typical example of such a smart card is disclosed in 

50 U.S. Patent No. 5,317.636 (Vizcaino). 

[0010] Another one of the developments is the Secure Electronic Transaction (SET) protocol which represents the 
collaboration between many leading computer companies and the credit canj industry which is particularty related to 
electronic transmissron of credit card details and in particular via the Internet. It provides a detailed protocol for en- 
cryption of credit card details and verification of participants in an electronic transaction. 

55 [0011] Another method that is particularty directed to the Intemet is described in U.S. Patent No. 5,715.314 (Payne 
et al.)- U.S. Patent No. 5 J 1 5.31 4 discloses using an access message that comprises a product identifier and an access 
message authenticator based on a cryptographic key. A buyer computer sends a payment message that identifies a 
particular product to a payment computer. The payment computer is programmed to receive the payment message. 
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to create the access message, and to send the access message to a merchant computer. Because the access message 
is tied to a parttcutar product and a particular merchant computer, theaccess message cannot be generated until the 
user sends the payment message to the payment computer. Because the access message is different from existing 
credit card formats, the access message is Ul-suited for phone/maif orders and other traditional credit card transactions. 
5 (0012] U.S. Patent No. 5.883,810 (Franklin et at.) describes an online transaction system in which a user of the 
Internet or the fike clicks on an icon to receive a proxy transaction number from a credit card provider. This proxy 
number stands in for the user's regular credit card number during transmission over the Internet, but expires after a 
short time (e.g., one hour) to reduce the chance that the number will be effectively intercepted and fraudulently used. 
The processing that occurs when a bank receives transaction information from a merchant involves checking whether 
10 the proxy number is a valid number and whether the transactk)n value and merchant match. There is no additional 
processing triggered, when the bank processing system receives the proxy number In addition, a significant drawback 
of the Franklin et al. system is that an unscrupulous merchant or a criminal who is capable of accessing or intercepting 
order details can then turn around and use the proxy number a number of times before the lapse of the expiration term. 
Thus, more than one transaction can occur within the duration of the expiration term. The Franklin et al. system has 
15 nothing in place to prevent this type of fraud. The Franklin et al. system merely depends upon an assumption that fewer 
criminals could obtain the proxy number and reuse it within the expiration term of the proxy transaction number set by 
the issuing bank than the total number of criminals capable of gaining access to credit card numbers used for online 
commerce. Also, the inclusion of specific transaction Information does not prevent a fraudulent merchant from recurrent 
unauthorized charges within the expiry time of the proxy number. The user will not be aware of this misuse of his/her 
20 credit card details until the receipt of the statement, which will typically not be until several weeks later. 

[0013] There are also specific electronic transaction systems such as "Cyber Cash," "Check Free" and "First Virtual." 
Unfortunately, there are perceived problems with what has been proposed to date. First, any form of reliance on en- 
cryption is a challenge to those who will then ^ to break it. The manner In which access has been gained to extremely 
sensitive information in government premises wouW make anyone wary of any reliance on an encryption system. 
Second, a further problem is that some of the most secure forms of encryption system are not widely available due to 
govemment and other security requirements. Limiting the electronic trading systems and security systems for use to 
the Intemet is of relatively little use. In addition, entirely new electronic payment systems require changes in how 
merchants handle transactions and this represents an important commercial disadvantage for such systems. 
[0014] Additk)nally. various approaches have been taken to make "card present" transactions more attractive. For 
instance. Japanese Patent Publication No. Hei 6r282556 disdoses a one-time credft card setUement system for use 
by, e.g.. teenage children of credit card holders. This system employs a credit card which can be used only once in 
which various Information such as specific personal information, use conditions, and an approved credit limit identical 
to those of the original credit card are recorded on a data recording element and displayed on the face of the card. 
The one-ttme credit card contains the same member number, expiration dale, card company code, and the like as on 
35 existing credft card, as well as one-time credit card expiration date not exceeding the expiration date of credit card, 
available credit limit for the card, and the like. The one-time credit card makes use of some of the same settlement 
means as the conventional a-edit card. However, the system also requires use permission information to be recorded 
on the credit card, the infomiation permitting the credit card to be used only once or making it impossible to use the 
credit card when the credit limit has been exceeded. A special card terminal device checks the information taken from 
the card for correctness and imparts use permis^on information for when the card is not permitted to be used on the 
transmission to the credit card issuing company. The use permission information takes the form of a punched hole on 
the card itself. This system has obvious drawbacks, such as Uie card tenninai having to be modified for additional 
functions (e.g.. punching holes, detected punched holes, imparting additional infomiation. etc.). Also, such a system 
offers little additional security insofar as fraud can still be practiced perhaps by covering the holes or othero/ise repladng 
the permission use information on the credit card. Further, such a system would require a change in neariy all card 
terminal equipment if it were adopted. 

1001 5] U.S. Patent Nos. 5.627.365 and 5,478,994 (Rahman et al.) disclose anothertype of system that uses a plurality 
of pm numbers which are added to a credit card number on an electronic display, U.S. Patent No. 5,627.355 discloses 
a credit card havmg a mennory element containing a series of passwords in a predetemvined sequence. These pass- 
words are identical to another sequence stored in a memory of a host control computer. Further the card contains a 
first fixed field containing an account number (e.g.. "444 222 333^. In operation, the memory element of the credit card 
device provides a unique password from the sequence with each use of the credit card device. This permits verification 
by comparing the account number and the password provided with each use of the device with the account number 
and the next number in sequence as indteated by the host computer. The host computer deactivates the password 
after the transaction. Among the drawbacks with this type of system is the need for a power supply, a display a memory 
device, a sound generator and the need to recycle a limited sequence of pin numbers. Such a system is 'not readily 
adapted to cun^nt credit card transactions because it lacks the ability of providing a check sum of the card number 
and cannot be read by a standard card reader. Also, if the card is lost or stolen, there is litOe to prevent a person from 
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using the card until it is reported to be lost or stolen by the correct holder. See, also, U.S. Patent No. 5.606,614 (Brady 
et al.). 

(0016] Other attempts have been made to make funds available to an individual, but with limitations. For example, 
U.S. Patent Nos. 5,350,906 (Brody et al.) and 5,326,960 (Tannenbaum et al.) disclose issuing temporary PINs for one 

5 time or limited time and limited a^dit access to an account at an ATM. These patents disclose a currency transfer 
system and method for an ATM network. In this system, a main account holder (i.e., the sponsor) sets up a subaccount 
that can be accessed by a non-subscriber by presenting a fixed limit card associated with the subaccount and by 
entering a password corresponding to the subaccount Once the fixed limit is reached, the card can no longer be used. 
The fixed limit card contains information on its magnetic stripe pertaining to the sponsor account. 

10 [001 7] One of the problems with all these systems Is thai there are many competing technologies and therefore there 
is a multiplicity, of incompatible formats, which wQI be a deterrent to both traders and consumers. Simtlarty. many of 
these systems require modifications of the technology used at the point of sale, which will require considerable invest- 
ment and further limit the uptake of the systems. 

15 OBJECTS AND SUMMARY OF THE INVEFfnON 

[0018] Many solutions have been proposed to the problem of security of credit card transactions. However, none of 
them allow the use of existing credit cards and existing credit card formats and terminal equipment In the exiting credit 
card system, which includes provisions for charge-backs, etc. Ideally, as realized by the present inventors, the solution 
20 wouW t>e to obtain the functionality of a credit card, vyrtiite never in fact revealing the master credit card number. Un- 
fortunately, the only way to erasure that master credit card numbers cannot f>e used fraudulently is to never transmit 
the master credit card number by any direct route, i.e., phone, mail, Internet or even to print out the master credit card 
number during the transaction, such as Is commonly the case at present. 

[0019] According to exemplary embodiments of the invention as described in U.S. non-provisional applications 
?5 09/235,836 and 09/506,830. a more secure way of using existing credit cards and, in particular, using existing aedit 
cards in remote credit card transactions was provided. These earlier applications were specifically directed towards 
providing a more secure way of using existing credit cards generally which will not require any major modifications to 
existing credit card systems. It is further directed towards providing a credit card system that will be user friendly and 
will provide customers with a greater confidence in the security of the system. 
30 [0020] The present invention includes a number of credit card products which have predefined characteristics. 

[0021] These and other advantages of the present invention are satisfied by a first exemplary embodiment, which 
pertains to a financial transaction system capable of using at least one limited use credit card number which is limited 
in use by a party other than a limited use credit card number issuer and which is associated the master account number 
of a customer, a method of controlling the validity of the limited use credit card number comprising the steps of: 

35 

sending to a user from a limited use credit card number issuer a limited use credit card number; 

communicating with a limited use card number card issuer to establish limitations on the use of the limited use 
credit card number by a third party before it can be used in a transaction by said user; and 

40 

authorizing transactions which meet said established limitations and denying other transactions by comparing at 
a central loration the attempted use to the established Itmitatjons on use. 

[0022] Ideally said use limitations include a combination of a present transaction amount limit and one of : a merchant 
<5 and merchant type and wherein transactions are reported to a supervising authority other than a user at one of: a time 
of transaction and at a time of said supervising authority's initiation. 

[0023] Preferably said limited use credit card number is activated upon receipt by said third party provider of a limited 
use credit card number of commercially valuable information finom the user of said limited use credit card number. 
[0024] In another embodiment said limited use credit card number Is activated and limited to a predefined monetary 
50 amount as setOement of a claim by said user of said limited use credit card number against said third party that provided 
said number to said user. 

[0025] Ideally said limited use credit card number is activated as a reward for activities of the user of sakJ limited use 
credit card number, 

[0026] Preferably the limited use credit card number is activated when a user is traveling and is limited in use to 
55 travel related expenses. 

[0027] In a further embodimem said limitations on use are established by a supervising authority receiving a specific 
request for a specific use by a supervised user, and the limitations reflect the content of the specific request 
[0028] Ideally said limited use credit card number is distributed using a Web Access Protocol enabled radw commu- 
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nlca^on dev'tce. 

[0029] Preferably said limited use credit card number Is distributedvia a non«PC web access enabled device. In 
another embodiment said limited use credit card number is placed on a non-embossed card. 

5 BRIEF DESCRIPTION OF THE DRAWINGS 

[0030] The foregoing, and other, objects, features and advantages of the present invention will be more readily un- 
derstood upon reading the following detailed description in conjunction with the drawings in which: 

10 Fig. 1 shows an exemplary system for imptementrng the present invention: 

Fig, 2 shows, in high-level font), the operation of the central processing station shown in Fig. 1; 

Ftg. 3 IS a flow chart illustrating an exemplary process for allocating credit card numbers; 

15 

Fig. 4 is a ftow chart lilustrattng an exemplary process for limiting the use of a credit card number; 

Fig. 5 is a flow chart illustrating an exemplary process for distributing credit card numbers; 
20 Fig. 6 is a flow chart illustrating an exemplary process for electronically using credit card numbers; 

Fig. 7 is a flow chart illustrating an exemplary process for processing a transaction; 

Fig. 8 is a flow chart Illustrating another exemplary process for processing a transaction; 

Fig. 9 Is a flow chart iHustratir^ an exemplary method of controlling the vaUdlty of a limited use credit card number; 

Fig. 10 is a flow chart illustrating an exemplary process for using a credit card number as a PIN number; 
30 Fig: 11 is a Wock diagram illustrating an exemplary location for the central processing system; 

Fig. 12 is a flow chart illustrating an exemplary method of conducting a limited use credit card number transaction; 

Fig. 13 is a flow chart illustrating an exemplary method of conducting a settlement transaction; 

35 

Fig. 14 is a block diagram illustrating an alternate exemplary location for the central processing system; 

Fig. 15 is a block diagram illustrating an alternate exemplary process for limiting, distributing and using a limited 
use card number; 

40 

Fig. 16 is a flow chart illustrating an exemplary method of providing remote access devices for accessing limited 
use credit card numbers; and 

Fig. 17 is a diagram illustrating how the present invention can place limitations on an configurable plastic payment 
^6 card to facilitate card-present applications. 

DETAILED DESCRIPTION 

[0031] In this specification the term A credit cards refers to credit cards (MasterCard7. Visa7. Diners Club7. etc.) as 
50 well as charge cards (e.g., American Express7, some department store cards), debit cards such as usable at ATMs 
and n^ny other locations or that are associated with a particular account, and hybrids thereof (e.g., extended payment 
American Express?, bank debit cards with the Visa? logo, etc.) or any other present or future financial transaction card 
having similar characteristics. Also, the tenns Amaster credit card number" and "master credit card" refer to the credit 
card number and the credit card as generally understood, namely, that which is allocated by the credit card provider 
55 to the customer for his or her account for multiple uses for a renewable period and a credit limit. It will be appreciated 
that an account may have many master credit cards in the sense of this specification. For example, a corporation may 
provide many of its employees with credit cards but essentially each of these employees holds a master credit card 
even if there is only one customer account. Each of these master credit cards will have a unique master credit card 
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number, which set of master credit card numbers will be linked to the account. Similarly, In families, various members 
of the family may hold a master credit card. a\) of which are paid for out of the one customer account. 
{0032] Additionally, the Amaster credit cards account can be in some embodiments something other than a credit 
card account For instance, while not otherwise affecting the fonmatting or processing of the limited use credit card 

5 numbers as described herein, the master card numt>er can be a prepaid account or another type of account, such as 
a utility, telephone service provider or Internet Service Provider (ISP) account. The utilrty company, telephone company, 
ISP or other account holder would generate a bill, which, in possible addition to or separate from to the regular bill, 
would include a listing of limited use credit card transactions. An advantage of this type of arrangement is that the 
service provider already has information as to a pool of individual and their credit worthiness, as well as low increased 

10 overhead due to the already in place billing system, in these emt>odiments, the Amaster account may but lii^ely does 
not have the format of a standard credit card or the like. 

[0033] The term AJimited-use= credit card number is used to encompass at least both the embodiment in which the 
credd card is designated for a single use, and the embodiment in which the credit card is designated for multiple uses 
providing that the charges accrued do not exceed a prescribed threshold or thresholds, such a total single charge, 
f 5 total charges over a limited time period, total charge in a single transaction, etc. A common feature is that the limited 
use credit card number is deactivated upon satisfactbn of a limrted-use condition, and not just the expiration date of 
the card. Stated differently, the a limited-use credit canj number is deactivated upon a use-triggered condition which 
occurs subsequent to assignment of said at least one credit card number. 

[0034] The term "deactivated" means that new transactions cannot be initiated using the same limited-use credit 
20 card number, but the limited-use credit card number is still available for further activity related to the original transaction, 
such as for charge-backs whene an account is credited, such as upon return of unaccepted merchandise. 
[0035] The terms "card holder" and "user" are used interchangeably to refer to an entity, e.g., an indivkJual, that has 
been rightfully issued a credit/debit/charge card number, e.g.. through a contractual arrangement, or that has been 
authorized to use such card by such entity or a representative of such entity. 

25 

1. Overview of System Features 

[00361 There are at least two basic diffierent ways of carrying out the present invention. In summary, the two ways 
are the allocation of additional credit card numbers for remote trade and the provision of what are effectively disposable 
30 cnedft cards for remote ami card present trade, both of which have the feature of in the case of single use or in the 
case of multiple use, protecting against the worst effects of compromised numbers fraud or skunomirtg. 
[0037] In a refinement of the invention, it is possible to control the manner in which an actual transaction is earned 
out as a further protection against unscrupulous providers of goods and services. 

[0038] Essentially, there are certain matters that will be considered in relation to this invention. They are the opera- 
3S tional or functional features in so far as they affect customers, and then there are the technical features, namely how 
the invention is implemented, how the invention is provided to the customers, and finally, how the invention is handled 
by the provkiers of goods and services and the processors of the credit cards, i.e.. the financial institutions and/or their 
service providers, 

[0039] The operational or functional features of this invention will be discussed first in the context of a standard credit 
card system. 

[0040] One basic feature of the invention is to provide in a credit card system such that each master credit card 
holder could be provided with one or more of the following; 1) additional single use credii card numbers for remote 
transactrons; 2) multiple use credit card numbers for remote transactions; 3) single use additional credit cards for 
remote and card present transactions; and 4) multiple use credit cards for remote and card present transactions. 

45 [0041] It is also envisaged that in certain situations credit cards can be provided to people who do not have an 
account with any credit card company. This latter feature is described in more detail below. Various other features may 
be provided in the above situations, which will further improve the security of credit cani transacttons. 
[0042] Dealing first with the situation where a master credit card holder has an additional credit card number allocated 
to him or her for a single use. it wifl be appreciated that since the number can only be used fbrone single transactk>n. 

50 the fact that the number is in anybody else's hands is irrelevant as it has been deactivated and the master credit cart 
number 4s not revealed to the third party. Various other features may be added to such single use credit card numbers, 
for example, the value of the transaction can be limited, thus the master credit card holder can have a plurality of single 
use credit card numbers of differing values. For example, when a remote trade is carried out, the master credit card 
hoWer will use a credit card numt>er which has a credn card limit only marginally above or equal to that of the value of 

55 the transaction. This would reduce the chances of or prevent an unscrupulous trader using the credit card number to 
supply additional goods or servkres over those ordered or to increase the agreed charge. 

[0043] A second embodiment of the invention provides the master credit card holder with an additional credit card 
nunnber for use in remote trade* which credit card number could have, as in the previous example of the invention, a 
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credit \\m\i for each specific transaction or a credit timit such that when the aggregate amount of a series of transactions 
exceeded a specific credit Hmit that the credit card number would be canceled, invalidated or in some other way de- 
activated. Similarly, the multiple use credit card number could be limited to. for example, five uses with a credit limit 
not exceeding $100 in each transaction and an aggregate credit limit not exceeding $400. Similarly, a time restriction 

s could be put on such a credit card number in that it would be deactivated if it was used wHh frequency above (or t}elow) 
a given threshold, for example, more than once a week. These limits and restrictions on the use of a limited-use credit 
card number can be and normally would t>e controlled by the consumer, such as the card holder or a person overseeing 
a card holder's use (e.g.. a parent, employer, gift giver, etc.). Hence, for timrted-use credit card number, the limitations 
of which are defined by a consumer rather than a card issuer, the term Controlled Payment Number, or CPN has been 

10 coined. 

[0044] It will be appreciated that the limits that can be placed on the use of a single use credit number or a multiple- 
use credit card number or CPN are almost limitless and those having sidll in the art will consider other ways in which 
the use of the credit card number could be limited, whether rt be by time, by amount, frequency of use, by geographical 
region, by merchant, by merchant dass. or by purpose or use (such as limited to Internet trade and so on), or bysome 

15 combination of these separate criterion. 

{0045] The third way in which the invention could be carried out is by physically providing additional single use credit 
cards each of which would have a unique additional credit card number. Such additional single use credit cards could 
then be used both for remote trade by using the additional credit card numbers for respective transactions, and for 
"card present" trade where each car6 would be "swiped" in the normal manner. Such a disposable credit card could 

20 be made like any common credit card, or from a relatively inexpensive material, such as cardboard or thin plastic, with 
the relevant information entered into it in readable (e.g., magnetic) form, as is already the case with many fonns of 
passes for use in public transport and the like. Again, substantially the same features as with the credit card number 
eould be provided. Thus, for example, the disposable credit card could be limited to use geographically, to a use. to 
an amount, to a frequency of use, to an expiration date, and so on. Again, those skilled in the art will appreciate that 

25 there are manyvariations to this concept. 

[0046] Another way of canrying out the invention is to provide a master credit card holder with a multiple-use additional 
credit card, where the additional credit card provides any limitations as to limited-use triggering conditions that maybe 
desired. 

[0047] Ideally, irrespective of the manner in which the invention is can-ied out, the master credit card holder would 
30 be provided with either a plurality of single use additional credit card numbers or multiple-use credit card numbers or 
a mixture of single and multiple-use credits cards. Several specific products are described in the last sectk>n of the 
present application. 

[0048] It will be appreciated that with either single use credit card numbers or single use additional credit cards, it is 
possible to eliminate or reduce the risk of credit canj number fraud. Further, depending on the credit limit imparted to 
^5 me particular credit card number or additional credit card number or single use additional credit card, it is possible to 
further limit the possibilities of fraud in any remote transaction and that with the use of a disposable single use credit 
card ft is possible to eliminate omeduce the risk of skimming. 

[0049] With multiple use additional credit card numbers and mufUple use additional credit cards, the above-identified 
problems may not be totally eliminated due to preferences of the user. This is because, in certa'm drcuwstances, credit 

^ card users may prefer to have, for example, an additional credit card number for remote trade with a specific credit 
limit that they use all the time and are willing to take the risk of compromised number fraud, in the sense that they can 
control the severity of this misuse. This would be particulariy the case where some of the various user triggered limi- 
tations suggested above are used with the additfonal credit card number. Substantially the same criteria would apply 
to an additional multiple use credit cand. 

<s [0050] Effectively, the present invention solves the problem by obtaining the functionality of a credit card while never 
in fact revealing the master credit card number as the master credit card number need never be given in a remote 
transaction. Further, the master credit card itself need never be given to a trader 

[0051] In another embodiment of the invention, it is envisaged that people who do not hold master credit cards could 
purchase disposable credit cards which would have a credit limit for the total purchases thereon equal to the amount 

50 for which the credit card was purchased. These couW then be used for both card present and card remote trade, the 
only proviso being that if the credit limit was not reached it will then be necessary for a refund to be given by the financial 
institution or credit card pn3vider. An obvious way of obtaining such a relvnd would be through an automatic teller 
machine (ATM). In this way. the existing credit card transaction system is employed and the card holder is given the 
convenience of having a credit card. 

55 [0052] As an alternative, the above-discussed cards could be. in effect, debit cards in the true sense, in which funds 
are withdrawn against a customer's account. In this case, the "credit card" issued, whether it be a one time use card 
or multi-use card, and whether have a credit limit or not. would be used to debit the account immediately. Preferably, 
the credit card issued in these circumstances wouki be single use with or without a transaction amount limit which 
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would be used and processed by the customer and merchant for a transaction as If it were a credit card, while in the 
customer's bank it woutd be treated like any other debit to the account. 

2. Exemplary Implementation 

5 

2.1 Implementation overview 

[0053] Various aspects of the invention may be embodied in a general purpose digital computer that is running a 
program or program segments originating from a computer readable or usable medium, such medium Including but 

10 not limited to electrical or magnetic storage media (e.g.. ROMs. EEPROMs, RAM, floppy disks, hard disks, etc.). op- 
tically readable media (e.g., CD-ROMs* DVDs, etc.), and carrier waves (e.g., transmissions over the internet) or com- 
binations thereof. A functional program, code and code segments, used to implement the present invention can be 
derived by a skilled computer programmer from the description of the invention contained herein. 
[0054] Fig. 1 shows an exemplary overview of a system for implementing the limited use credit card system of the 

15 present invention. The system 100 comprises a central processing station 102, which, accordingly to exemplary em- 
bodiments, may be operated by the credit card provider. Generally, this station 102. receives and processes remotely 
generated credit card transactions. The credit card transactions can originate from a merchant in the conventional 
manner, e.g., by swiping a credit card through a card swipe unit 106. Alternatively, the credit card transaction requests 
can originate from any remote electronic device 104 (e.g., a personal computer). These remote devices can interface 

20 with the central processing station 102 through any type of networi^. including any type of public or propriety networi^s, 
or some combination thereof. For instance, the personal computer 104 interfaces with the central processing station 
102 via the Internet 112. Actually, there may be one or more merchant computer devices (not shown) which receive 
credit card transactions from the remote electronic device 1 04, and then fonvard these requests to the central process- 
ing station 102. The central processing station 102 can also interface v«th other types of remote devices, such as a 

^5 wireless (e.g.. cellular telephone) device 140, via radio communication using transmitting/receiving antenna 1 38. Other 
Intermediary components can be interposed, as is conventional. 

[0055] The central processing station 102 itself may include a central processing unit 120, which interfaces with the 
remote units via network I/O unit 118. The central processing unit 120 has access to a database of credit card numbers 
124, a subset 126 of which can be designated as being available for limited use (referrBd to as the "available range"). 

30 Also, the central processing unit 120 has accessto a central database 122. refen-ed to as a QjonditfonsO database. 
This database is a general purpose database which stores infomnation regarding customers* accounts, such as infor- 
mation regarding various conditions which apply to each customers' account. Further, this database 122 may store the 
mapping between a customerOs fixed master credit card number and any outstanding associated limited use credit 
cards, using, for instance, some type of llnked-list mechanism. Databases 122 and 124 are shown separately only to 

35 iHustrate the type of information which may be maintained by the central processing station 102; the information in 
these databases can be commingled in a common database in a manner well understood by those having skill In the 
data processing arts. For instance, each limited use credit card number can be stored with a field, which identifies its 
master account, and various conditions regarding its use. 

[0056] The central processing unit 120 can internally perfomi the approval and denial of credit card transaction 

^ requests by making reference to credit history information and other infomiation in the conventional manner. Alterna- 
tively, this function can be delegated to a separate clearance processing facility (not shown). 
[0057] Finally, the central processing station includes the capability of transmitting the limited use credit card numbers 
to customers. In a first embodiment, a local card dispenser 128 can be employed to generate a plurality of limited use 
cards 132 and/or a master credit card 134 for delivery to a customer. In a second embodiment, the limited use credit 

« card numbers can be printed on a form 136 by printer 130. which is then delivered to the customer via the mail. The 
printed form 136 may include material which covers the numbers until scratched off, thereby indicating what numbers 
have been used and are no longer active. This listing of numbers can be Included in a monthly or other periodic account 
statement sent to the customer. In a third embodiment, these limited use numbers can be elertronically downloaded 
to a usefCb personal computer 104. where they are stored in local memory 142 of the personal computer 104 for 

50 subsequent use. In this case, the credit card numbers can be encrypted (described In detail later). Instead of the 
personal computer 104, the numbers can be downloaded to a userCb smart card though an appropriate interface. In 
a fourth embodiment, the single-use credit card numbers can be downloaded to a radio unit 140 (such as a portable 
telephone) via wireless communication. In a fifth embodiment, an ATM 108 can be used to dispense the limRed use 
cards 110. Those skiHed in the art wHI readily appreciate that other means for conveying the numbers/cards can be 

55 employed. These embodiments are. of course, usable together. 

[0058] The logfe used to perform the actual allocation and deactivation of limited use credit card numbers preferably 
comprises a microprocessor, which implements a stored program within the central processing unit 120 Any general 
or special purpose computer will suffice. In alternative embodiments, the logic used to perform the allocation and 
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deactivation of the limited use credit card numt)ers may comprise discrete logic components, or some combination of 
discrete logic components and computer-implemented contnol. 

[00591 ^^jg- 2 shows a high-level depiction of the functions performed by the central processing station 102 or the 
like. The process t>egins in step 202 by allocating one or more limited use numbers to a customer. These numbers are 
utttmateiy selected from the list 126 of available limited use numbers, or some other sub-set list which has been pre- 
viously formed from the numbers in list 126. Also, although not shown in Fig. 2, a master account number would have 
been preferably assigned to the customer at a previous point in time. The conditions database 122 may comprise a 
mechanism for associating the master account number (which can be a credit card number or some other type of 
account) number with the limited use credit card number. Because the limited use cards are arbitrarily chosen from 
the listing 126 of limited use card numbers, there should be no discernable link which would allow anyone to determine 
the master credit card number from any of the limited use numbers. 

[0060] The processing then advances to step 204, where it is detenmined whether a customer requests or an event 
triggers a request for additional limited use cards or card numbers. If so, additional limited use cards or card numbers 
are allocated to the customer. 

[0061] Processing then advances to step 206, where the central processing station determines whether a transaction 
has taken place using a previously Issued limited use card. This step is followed by a determination (in step 208) 
whether the limited use number should be deactivated. For instance, if the card is a single-use card, It will be deacti- 
vated. If the card is a fixed-limit card, the card is only deactivated If the recent transaction exceeds some stored threshold 
limit. These threshold limits can be stored on the card itself or in the conditions database 122. The actual step of 
deactivating is performed by generating a deactivation command, as represented in step 210 shown in Fig. 2. Naturally, 
there are other steps to processing a credit card transaction, such as checking whether the card is deactivated or 
otherwise invalid prior to completing the transaction. These additional steps are system specific and are not discussed 
here for sake of brevity. 

[0062] Once a number is deactivated, this number can not be fraudulently reused. Hence, the risk of fraudulent 
capture of these numbers over the Internet (or via other transmission means) effectively disappears. In an altemaUve 
embodiment of the invention . these deactivated numbers can t>e reactivated prc>viding that a sufficiently long time since 
their first activation has transpired. Providing that there is a sufficiently large number of limited use credit card numbers 
to choose from, it would be possible to wait a long time before it was necessary to repeat arry numbers. At this point, 
it would be very unlikely that someone who had wrongfully intercepted a credit card number years ago would be mo- 
tivated to frauduientiy use it before the rightful owner. 

[0063] After the limited use card is deactivated or a number of limited use cards are deactivated, an additional limited 
use card or cards can be activated. As described in detail in the following section, the actual activation of the credit 
card number can involve various intermediate processing steps. For instance, the credit card numbers from the list 
126 can be first allocated to an "allocated" range of numbers, and then to an "issued but not valid" range of numbers, 
and then fmaHy to an "issued and vafid* range of numbers. Rg. 2 is a high-level depiction of the process^ and encom- 
passes this specific embodiment, as well as the more basic case where the credit card numbers are retrieved from a 
database and then immediately activated. 

[0064] Having set forth a summary of how the Invention can be implemented, further details are provided in the 
folkDwing. 

2.2 Allocation of the credit card numbers 

[0065] The first thing that the credit card provider may do is to generate a list of addiUonal credit card numbers, 
whether they be single use or multiple use, and allocate additional credit numbers to a master credit card as a further 
credit card number for optional use instead of the master aedit card number. Such a list can be produced by any 
suitable software package in the exemplary manner discussed In more detail below. Because the numbers allocated 
to a particular master credit card holder will not have any link to the master credit card number, the master credit card 
number should not be able to be derived firom the additional credit card numbers, 

[0066] In effect, randomness in credit card numbers is provided by the fact that there is a queue formed by the 
customers requiring numbers. Further, it should not be possible, even knowing the additional credit card numbers in 
a particular master credit card holder's possession which he or she may have used, to predict the next set of numbers 
that that partrcular master credit card holder will be allocated, since there wlH be randomness of access to additional 
credit card numbers in the truest sense. Even if the credit card provider were to allocate numbers sequentially there 
wouW be no way of predicting the number that that credit card holder wouW subsequenUy acquire, since the numbers 
would be altocated by virtue of a queue, the randomness of this allocation being such as to prevent any prediction 
[0067] As such, the credit card numbers generated by the central computer need not be per se random numbers 
Preferably, though, these numbers are valid credit card numbers with the constraint that they must conform to industry 
specifications of the fomiat in tenns of their numerical content in such a way that they can be handled with no (or 
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minimal) modifications by nrwrchant/acquiring systems and networks and be routed to the appropriate center for 
processing. An additional constraint is that they must be different from ait other conventional account numbers and all 
other single use numbers during their lifetime of vaiidity. These constraints are practical requirements to produce a 
commerciaHy viable system, which would iikeiy not be satisfied by any process that generates random numbers in 
5 isolation. 

{0068] To achieve these allocation requirements, an issuing bank decides within its total available range of credit 
cards to allocate a certain range or ranges of numbers to the single use system, referred to herein as the "available 
range." This may represent spare numbers using existing header sequences (e.g., the sequence of usually 4-6 digits 
that define the issuing institution and are used to route the card to the appropriate transaction processor) or within 

fo newly created header sequences. The numbers not allocated include existing credit card accounts for that issuer and 
sufficient spare capacity for new account hokiers and replacement numbers for existing customers. The additional 
non-embossed components of the card details and any card specific information that is transmitted during a transactkm 
may be varied from card to card to enhance security and privacy of credit card transactions. 
[0069] Although each limited use number is unique during the its lifetime of validity, information required to route the 

IS card number and transaction details to the appropriate processor is maintained to ensure that limited use numbers are 
processed appropriately. However, the limited use numbers do not need to include either the master card account 
number or an encoded version of the account number. Indeed privacy and security are enhanced when no unique 
account hokier identifier is included within the limited use credit card number. 

[0070] Also, information that is verified prior to the card being processed for authorization and payn^ent, such as 
20 expiry date and checksum digit must be valid. This information may vary from limited use number to limited use numt>er, 
but must be valid to ensure that the nvmbBr passes checks that may be completed within the merchant terminal, i.e., 
the checksum is appropriately calculated for each limited use number and the associated expiry date is valid at the 
time of use. 

[0071] Within the constraint of using a valid credit card fonnat. the random allocation process used to generate lists 
25 of mique limited use numbers can involve altocation finom a range of numbers in which either the entire number or 
portions of the account number are varied. In addition, the allocation can include combinations of all or part of the 
account number together with alt or part of additional information such as non-embossed additional numbers, expiry 
date and other information that identifies the card and is passed on by the merchant to the card processor during a 
transaction. 

30 [0072] Sequential random aibcatk>n from a list of available valid credit/debit/charge card codes that have been solely 
allocated for use as limited use numbers ensures that the criteria specified for limited use numbers are met, i.e., no 
two limited use numbers are the same, no limited use number is the sameas an existing account number, and no newly 
issued conventional card number is the same as a previously issued limited use number. To achieve true computational 
independence between account numbere and limited use cards and between limited use numbers for the same account. 

35 the random altocation pixicess requires a Iruh^ random seed value. Such true randomness can be obtained from a 
physically random system with well-defined properties such as a white noise generator. An analog to digital converter 
that receives an analog signal from such a truly random physical system can be used to ensure truly random allocation. 
[0073] Other approaches can result in the same result with lower computational efficiency. For example the allocation 
process could randomly select valid credit card numbers within the entire range for a given card issuer and then discard 

40 the number if it is already in use as a limited use or conventional card number or if the same number was allocated 
within a given time frame. 

[0074] The above process generates a series of available single use numbers. To repeat, the allocation process is 
achieved by a truly random (or less Weally a pseudo random) mapping process in which a single use number is randomly 
setected and then assigned to a.selected account holder (either an existing credit/debit card holder, a new solely single 

45 use account holder or a bank account). Additional single use numbers can be allocated for purchase on an mdmdml 
basis. Each assigned single use number is then removed from the sequence of available numbers before the next 
allocation, ensuring a unique allocation of each single use number. An alternative mechanism for performing direct 
alkication to a specific account holder is for lists of single use numbers to be alfocated to unique storage locations. 
The list from a specific storage locatiort can then be directly alk>cated.to a given account at a later date. This allows 

so for rapid allocation of cards to new customers without any delay arising from the need to perform a new altocation 
procedure for each newx^stomer, 

[0075] This allocation process generates another series of single use numbers, the "allocated range* with an asso- 
ciated identifrcation field to determine how the account will be settled once used, i.e.. onto whose account the transartion 
will be charged. The attocatton process can occur a sSgnifteant time before the single use numbers are required. Once 
55 allocated, they are not added into the list of valid accounts until required by the user. 

[0076] Fig. 3 is a flow chart illustrating an exemplary process for altocating credit card numbers. A central processing 
unit (CPU) generates a database of credit card numbers (step 302), and may select a master credit card number. (Step 
304). In step 306. the CPU checks to make sure that the master credit card number is not the same as another credit 
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card number The CPU selects additional credit card numbers to allocate to the master credit card number or other 
type ot account number. (Step 308). The CPU can use any of the techniques discussed above to select the additional 
numbers. In step 310, the CPU checks to make sure that the additional numbers are not the same as another credit 
card number. The additronal numbers can be used, for example, for single use cards. 

5 [0077] When a customer needs multiple-use cards, the CPU can issue the additional credit card numbers to the 
customer. Unless these multiple-use numbers are issued directly into the hands of the customer (e.g., by an automated 
teller machine (ATM)), they are not directly added to the list of valid account numbers held within the central computer 
system. These numbers are added to an "issued, but not vaiid" list of numbers. (Step 312). The number of multipie- 
use numbers issued at one time depends upon the rate at which the customer will use the cards and the capability of 
the device used to store the muitipte-use numbers until used. The CPU can provide the customer with enough multiple- 
use numt>ers to ^tfiil their multiple-use purchase requrements for up to, for example, 2 years. Each multiple-use 
number can be endowed with specific restrictions in terms of transaction type or value, provided that these properties 
do not exceed the restrictions placed up on the customer's account (such as the available credit balance). 
(0078] Once a series of multiple-use numbers are issued, the user has the option of confirming receipt by telephone 

t5 or other communication media before any of the issued numbers become validated on the processing system. {Step 
314). Once receipt has been confinned (or assumed), not every issued muttiple-use number is necessarily added to 
the "issued and valid" list. (Step 316). To prevent excessive valid multiple-use numbers being held within the processing 
system, the number of multiple-use numbers declared to be valid at any one time is limited to account for waste of 
numt>ers (i.e.. numt>ers that are accessed by a customer but are never used to complete a transaction) and to alfow 

20 for time delays between different transactions leading to differences in the sequence in which multiple-use numbers 
are accessed by the customer and the sequence in which they arrive at the processing center. The maximum number 
of multiple-use numbers valid at any one time can be determined by the card Issuer but would be preferably in the 
range of 5- 10. In the case of any attempted use outside the allocated range, the next multiple-use number can be used 
as an additional identifier to validate the transaction. In this case, only a subset of the digits should be given by the 

25 user to prevent a fraudulBni trader being able to gain access to multiple unused multiple-use numbers. As soon as a 
single use number is disabled (step 320) on use (step 318), an additional number from the "Issued not valid" list for 
that customer is allocated to the "issued and valid" list, ensuring a continual supply of multiple-use numbers up to the 
maximum allowed until the next set of multiple-use nurribers are issued. (Step 322). 

[0079] In relation to the actual supply of the additional credit card numbers, this will not cause any difficulties to the 

30 credit card provider. For example, with a standard master credit card number, there are up to fifteen or more digits, the 
first of which Is used to identify the credit card provider, e.g., American Express?, VISA7, Mastercard?, etc. For major 
banks, three digits are used to identify the issuing bank. The last digit in a typical sixteen digit master credit card number 
is a checksum used to confinti that the number is a valid number. This leaves a total of up to 11 digits or more for the 
account identifying number and the expiration date. In some instances, the expiration date may not be sent back for 

35 clearance, while with certain credit card provkJers, additional credit card numbers or even additional information is 
required for clearance. For example, certain credit card providers print additional numbers on the card, which additional 
numbers are not embossed on the card and do not form part of the master credit card number. These addittonal printed 
and non-embossed credit card numbers can be used to identify that the person proffering the card for a non-present 
card transaction is actually In posse$sk>n of the card when the order is made whether it be in writing or by phone. There 

40 are many devices, digits, pieces of information, etc. used by a anedit card issuer or processor worthing for a credit card 
issuer to clear the credit card for the specific transaction. According to another embodiment, when issuing additional 
credit card numbers in accordance with the present invention, such additional credit card numbers could include a 
code which would identify that the person using the additional credit card number in a remote transactfon Is the one 
to whom the numbers were sent or, in the case of a disposable aredit.card, is the one to whom the disposable credit 

45 card was sent 

[0080] A prefened feature of these additional credit card numbers is that they be constrained to be in the correct 
fomnat for a credit card number with a valid check sum, while at the same time be mathematically unrelated to each 
other or to the master credit card. In certain situations, for single use numbers, the expiration date is virtually in-elevant. 
Thus, using the month code of the expiratfon date with said eleven digits, there are 12 x 1 0^^ i.e.. 1 .2 x W^^, i.e., 1 ,200 
50 billion possible unique codes available for any given credit card provider This would allow for 50 transactions a month 
for 10 years for 200 million account holders, before any codes would have to be recycled or a new header code intro- 
duced. When it is understood that there are then another 10^ header numbers that a credit card provider can use, it 
will be appreciated that the structure and anangemeni ot existing master credit card numbers is sufficient to operate 
this mvention with the advantage that the existing infrastructure of dealing with aedit card transactions can be used 
wrth minimum modification. All that is required for the credit card provider is to store the generated numbers against 
the master credit card number or other type of account numt)er. 

[0081] If. for example, the card is a VISA7 card, there are approximately 21.000 issuing banks. The sixteen digit 
number has a "4" foUowed by a.fiva digit code to identify the card issuer. The last number is a checksum to verify that 
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it is a vatid number. As a result, there are 21 ,000 x 10^ x 12 (252 trillion) unique numbers and associated expiry months. 
This number of codes is sufHcient for36,000 years of transaction processing at the current annual rate of approximately 

7 billion transactions per year. 

[0082] While existing credit card formats allow for a sufficiently large number of available card numbers, numbers 
5 will eventually need to be recycled for allocation. As the range of available numbers reduces in size overtime, additional 

or recycled numbers should be added back into this range to ensure that the allocation process is performed from a 

range sufficiently large to maintain random allocation. The length of time prior to recycling depends on the total number 

of available unique card codes available to an issuer and the number of transactions that use limited use numbers. 

Such recycling can only occur after a number has been invalidated for further use and Is no longer valid for refunds. 
10 Once recycled, automatic fraud detection mechanisms that would normally be activated on the attempted reuse of a 

previously inactivated card need to be altered by removing the recycled number from the list of previously issued limited 

use numbers. 

2.3 tJmitations on the use of the credit card numbers 

IS 

[0083] The use triggered condition subsequent limitations placed on limited use canj numbers, i.e.. transaction value 
limitations, number of transactions limits, etc., are central to their additional flexibility and security compared to con- 
ventional credtt/debit/charge cards. These limitations can be imposed and controlled in a variety of ways. For example, 
the limitations can be stored within a database held by the card issuer and used to check that the transaction falls 

20 within these limitations during the authoriation process. 

[0084] Fig. 4 Is a flow chart illustrating an exemplary process for limiting the use of a credit card number. A CPU can 
allocate a aedit card number to a master credit card number (step 402), and allocate a condition to the credit card 
number. (Step 404). The CPU can then store the condition in a database of conditions. (Step 406). These limitations 
can be assigned by the issuer in a predetermined manner or can be imposed according to the requests of the card 

25 holder. These limitations can be encoded with the limited use numbers Virtien the numbers are issued to a user so that 
the user can determine the limitations associated with a particular card. These limitations can be altered once a number 
is issued by updating the issuer database and the user maintained list of numbers. Communication between the user 
and card Issuer to make these changes can be posted, conveyed verbally or electronically. (Step 408). When the card 
is used for a transaction (step 410), the transaction details are compared by the processing software with the limitations 

30 and the transaction is authorized only if the transaction falls within these limitations. (Step 412). Alternatively, the 
limitations can be encoded within part of the number fomiat that is transmitted during a transac^on. The limitations 
would then be decoded from the transmitted transaction details by the card processor. This would offer the user more 
control, but would offer less security since knowledge of the encoding format could be used to fraudulently alter the 
limitations chosen by altering the appropriate portion of the limited use number format. 

35 [0085] As Internet commerce develops, there wiil be an Increased need for a wide range of frnancial transactions. 
The limitations placed on limited use card numbers can be used to implement a viride range of payment options. For 
example, a credit card number can be limited to a single transaction for a pre-arranged transaction limit. Alternatively, 
a credit card number can be used, for example, to implement an installment plan where the credit card number is, for 
example, only valid for twelve payments for a pre-arranged transaction limit for twelve months to a single merchant 

40 This plan provides security against fraud because it is locked to a single merchant, and it is only good for one year. 
Similarly, a credit card number can be used to implement a debit plan where the credit card number is limited to a 
specifc merchant. 

[0086] When the limited use number is limited to a specific merchant, the merchant can be prearranged by the user 
or can be determined by first use. In this situation a limited use card can be used to generate an account specific to a 

<5 single merchant. For example, this can be used in situations on the Internet where a web merchant will retain a credit 
card number for later purchases. By being limited to a single merchant, theft of the number from the merchant's com- 
puter systems will not allow the card to be used elsewhere. Also, any such use wiH immediately identify a specific 
merchant as having suffered a security breach. Determlnation-by-flrst use could invoh^ linking the merchant name or 
credit card system identification number at the time of making the purchase, during the authorization process or during 

50 the settlement process. 

[0087] Finally, a credit card number can be used as a gift voucher where the credit card number is limited to a specific 
transaction value or limit, but It can be used for any merchant. A gift voucher limited use card could also have a pre- 
determined limitation to a specific merchant or a type of merchants or to a group of merchants such as within an Aonllne 
shopping mails. 

55 

2.4 Distribution of the credit card numbers 

[0088] The next matter that is considered is how these additional credit card numbers and/or additional credit cards 
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are distributed to a credit card holder. One way of providing such additional credit card numbers and/or additional creriil 
cards is to in some way provide them physlcalty to the master credit card holder, whether it be by collection, delivery 
by courier, post or some other way which can generally be covered under the heading of provision by post. Obviously, 
the financial institutions wish to provide the additional credit card numbers or the additional credit canjs to the user as 

s efficlentty as possible with the minimum risk of the additional credit card numbers and/or cards falling into a third party's 
hand. White one can never prevent theft, for example, of a credit card from a user, what is Important is to ensure that 
these disposable credit cards and/or credit card numbers are delivered to the user with the least possibility of a third 
party obtaining either the numbers or the disposable credit cards from the time they are generated until the time they 
are physically received by the user. 

f 0 [OOdd] It is envisaged thai there are various methods by which a credit card provider could issue the additional credit 
card numbers, and/or credit cards to the user. One of the simplest ways would t>e to post them on request. Another 
way would be for the credit card provider, after receiving a payment of an account or with a statement of an account, 
to provide a sufficient number of additional credit card numbers and/or additional credit cards to replace the ones used 
since the previous statement. Particularly, if such statements do not quote the master credit card number or some code 

i& number, it would be possible to put in acMitiona) checks on the activation of the additional credit card numbers or credit 
cards. Some form of receipt system could be used, in this way effective theft would be reduced. 
{0090] fig. 5 is a fbwchart illustrating an exemplary process for distributing credit card numbers. A credit card issuer 
allocates a master credit card number or more genericalty a type of master account number to a master credit card or 
account owner. (Step 502). The credit card issuer then allocates limited use numbers to the master account number. 

20 (Step 504). For pre-prepared cards, the card issuer can decide whether to print (or incorporate by some other means 
such as embossing) one number per card or multiple numbers per card. (Step 506). The card issuer can distribute 
multiple numbers using a single card (step 508) or distribute multiple numbers using multiple cards. (Step 512). 
10091] \n eWher case, it is important that the user can keep track of which numbers have been used. If the card has 
only one number, an opaque removable cover can be used to cover one or more portions of the card. (Step 510). For 

?5 example, the opaque removable cover can cover the number portion of the card, so that the cover has to be removed 
before the card can be used. The act of removing the cover indicates that the card number has been accessed or used. 
[0092] Alternatively, an opaque removable cover can conceal a message such as Aused.= The opaque removable 
cover can be a scratch off layer that is scratched off before or after the card is used. The scratch off layer can resemble 
the layer that is often used to cover tottery numbers or the tike. Or altematively, the single use cards can be placed in 

30 a self-contained container that resembles a razor blade dispenser. (Step 516). The owner can remove a single use 
card from a first compartment and then place the used card into a second compartment. 

(0093] If the card has multiple numbers, the owner can keep track of the numbers by using a device that covers one 
or more portions of the card. (Step 510). The device can cover the numbers until they are used. As described above, 
the device can comprise multiple opaque layers that must be removed prior to the use of each number, Altematively, 
35 each number oHild be visible when the card is issued and each number is associated with a panel in whk:h an opaque 
covering conceals a message that indicates that the number has been used. After each use. the cooesponding covering 
is removed or scratched off to indicate that the number has been used. 

[0094] In both above cases the solutions incorporated on the cards act to remind the user which numbers have been 
used. The critrcal check on the validity of the number is performed by the processing software responsible for auth^orizing 
40 card transactions. 

[0095] The additional credit card numbers and/or cards can be sent with a statement. (Step 518). The additional 
credit card numt>era are not activated until the statement is paid. (Step 520). The card Issuer could also require that 
the payment be accompanied by the master credit card number or another identifier. Or, for example, an additional 
security step involving either direct contact with the issuing credit card company or an independently issued password 
45 to allow activation of an electronic device could be used. 

[0096] A further way in which the additional credit card nunibers and/or additional credit cards could be distributed 
to the user is byway of an ATM machine. (Step 522). The ATM machine with very Httie nKJdIfication could provWe the 
additional credit card numbers. Similariy, with relatively little modification, an ATM machine could provide addittonal 
credit cards. 

so [0097] Cards/single use numbers can be issued directly into an electronic device that is capable of storing such 
numbers. This applies to mobile phones and pager devices to which Infomnatlon can be transmitted using existing 
systems and computers connected either directly or via a telecommunications system to the Internet or a specific host 
computer system. In such a situation a mechanism is required to protect these numbers in transit to prevent unauthor- 
ized access. Forgtobal applications, this mechanism must not be subjectto export restrictions. In addition, this pre- 
ss taction should not be susceptible to "brute force" decryption techniques. Such a system is described below in relation 
to the storage of single use cards. 

{0098] An alten^ative method to provide additbnai credit card numbers could be by way of a computer programs. 
Obvrausly it would be necessary for the credit card provkJer to have sufficient security that when the computer program 
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was dispatched* either through the telecommunications network or through the post, that unauthorized access could 
not be obtained. 

2.5 Etec^fonic use of the credit card numbers 

5 

[0099] In the situation where the user stores and accesses Hmrted use numbers via an efectromc device such a 
computer of any fomi (desktop, television or cable linked Internet access device, laptop, palmtop, personal organizer, 
etc), any device that can defiver the same functions as a computer or dedicated Internet access device, a dedicated 
microprocessor device with key pad and screen or any form of telephone with associated microprocessor controlled 
electronics, (he associated software can perform some or all oi the foDowmg functions: 

1) Password controlled access to software or other s^xirity activation system that can verify that the user has a 
valid right of access. 

1 5 2) Secure storage of issued limited use credit/debit/charge card numbers untii required by the user. These numbers 

can be stored in a variety of encrypted forms. An additional security step is to encrypt the number in the form a 
valid credit card number as previously described. 

3) Secure storage of transaction details and date of use for reconciliation with records heki by the credit/debit/ 
20 charge card company in case of disagreement. This may mdude digitaity signing each transaction record. 

4) Facility for user to review past usage of limited use card numbers and transactions. 

5) Notification to user of available number of limited use cards. 

25 

6} Initiate automated request from software to card issuing organization or agreed agent for further cards to be 
issued by previously agreed route if requested by user or If the number of avBilable Jimited use cards is less than 
a pre-arranged limit. 

30 7) Secure communication between software package and card issuing organizatk>n or agreed agent for download- 

ing additional limited use numbers. This secure communication can exploit any available form of encryption suitable 
for this purpose. 

8) Secure communication between card issuing organization or agreed agent and the software package for the 
35 transmission of information regarding credit card transactions, account balances and other infonmation as request- 
ed by the user or card issuer. This secure communication can exploit any available form of encryption suitable for 
this purpose. 

9) Automated or manual means for transfer of credit card information to the merchant. The software can integrate 
40 wfth Internet software in the sffuatron where ft is run on a devias linked to the Internet or simiiar electronic network 

and allow automatic transmission of transaction details if the merchant software soallows. To ensure compatibility 
with any form of merchant software the user also has the option of dragging and dropping a limited use number 
displayed by the software onto the appropriate part of a web page, or manually entering the number. In the case 
a deyk:e intended for use over the telephone, the number can either t>e spoken by the user or appropriate tones 
<s can be generated to automatically transmit the number to the merchant. 

10) Use of digital signature verification to verify both parties of a credit car<i transaction (i.e. merchant and card- 
hokler). 

50 11) Use of digital signature veriftcatton to verify both parties of a communication involving the transmission of 

financial information or additional limited use card numbers (i.e. card issuer and cardholder). 

12) Use of stored lists of limited use numbers held by user and card issuer as dynamic passwords to verify both 
parties (user and card issuer) of' a communication involving transmission of financial information or additional 
55 limited card numbers. 

(0100] For 'card not present" transa<^ions, it is proposed that the customer uses an electronic device to store issued 
single use numtjers. This may repres nt a range of devices from a mobile telephone, pager, dedicated single use 
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storage device or a software package that can run on range of platfonns such as a conventional desktop conr»puter, 
television based Internet access device (e.g., WebTV) or a portable computing device: 

[0101] The software that is used within these devrces for storing and accessing these numbers will have specific 
features that are common to at! platforms/devices. 

5 [0102] For s&Gunty reasons, access to the software will be password protected or protected by another security 
system that allows identification of the user (e.g., magnetic stripe card reader, chip card reader, electronic token gen- 
erator, fingerprint recognition system or the like). Multiple passwonJs may be employed to provide limited access to 
certain individuals, for example limiting access for a family member to single use numbers with specif pre-allocated 
limits on application or maximum transaction value. 

10 The single use numbers are preferably stored in a secure form involving one or more encryption systems. It is proposed 
that a dual system wiii be. employed using a standard protocol (e.g., DES or RSA encryption) and a specific system 
designed for credit cards as described below. 

[0103] "Brute force" decryption involves using multiple fast computers and specific algorithms to test large numbers 
of possible encryption "keys." Success can be determined by seeing whether the result appears in the expected format. 
15 for example as comprehensible English text in the case of an encrypted document. If the encrypted version is in an 
identical format to the unencrypted versbn (though with different informaUon) then brute force decryptkjn cannot suc- 
ceed. This is not a computationally viable option for text but it Is possible for credit cards. 

[0104] The approach is to break down each component of a credit card number and encrypt these with a private 
password so as to maintain the numerical composition of each component. The end result should be securely encrypted 

20 but should not represent another existing credit card account. This can be achieved by constraining the encryption 
system to convert the credit card header sequence used to identify the issuing bank (usually 4-6 digits) into a currently 
unused sequence. Since this information will be constant for all cards from the same issuer, this infornwrtion should 
be randomized (rather tfian encrypted) to prevent recognition of a.valid decryption solution. Once the rest of the number 
is decrypted by the program, the appropriate header sequence can be added. The remaining digits excluding the 

25 checksum (the last digit) are then encrypted using any private key encryption system that will maintain the same number 
of digits and produce a result that represents the numerals 0 to 9. The expiration date and any other Identifying digits 
are also encrypted in such a manner as to respect their existing structure, i.e., the month is encrypted between 1 and 
12 and the year is encrypted so as to represent a number within the next three years that ensures that the expiration 
date is valid. f=oHowrng these steps, the digits used to calculate the checksum in a normal card number are processed 

30 to cateulate a valid checksum for the encrypted card. The result is a valid appearing credit card number that has a valid 
checksum and which can be guaranteed not to belong to any existing credit/debit card account holder. 
For example, for a card with a 6 digit header and valid checksum, e.g. . "1 234 5678 90 1 2 3452 expiration date of 1 2/99." 
123456 is randomly assigned to a currently unused header sequence, e.g., 090234 (this is an example and does not 
necessarily represent an unused header sequence). 789012345 is encrypted into another 9 digit number, e.g., 

35 209476391. 12/99 is encrypted to a valid date format that ensures the card is not expired, e.g.. 3/00: The checksum 
is recalculated to produce a vsM6 appearing credit card number, for this example the checksum is 4 i e 0902 3420 
9476 3914 expiry 3/00. 

[0105] To decrypt this number for use or after transmission from the bank, the appropriate header sequence for the 
issuer is exchanged for the digits in the encrypted nurr^. The other digits are decrypted using the private password 

40 and the check-sum is recalculated. 

[0106] Provided that the header number is unused and the private password remains private, then this number is 
encrypted in such a way that brute force encryption cannot be used to determine the original number, since it will not 
be possible to determine when thecorrect solution has been reached. In eombination with standard encryption systems, 
this allows a means to s^airely store credit cards and transmit them over insecure systems with confidence. 

« [01 071 Once the appropriate password is entered into the software, the next available single use number is decrypted 
and either displayed, allowing the customer to use it in any forni of trade that can achieved by quoting credit card 
information, or directly transmitted via the software to the merchant. Once used, the single use number is removed 
from the stored list The date of access, the number accessed and any additional availabte transaction details are then 
stored in a secure fashion and digitally signed to allow for verification inthecaseof a disputed transaction. Each access 

so to a single use number requires the entry of a password to prevent unauthorized access if the customer leaves his 
software/computer device unattended and active. 

[0108] Other types of encryption may also be used, for example, which require the use of a mask and/or private key. 
For example, as described above, this approach also breaks down and encrypts each component of a credit card 
number so as to maintain the numerical composition of each component Similar to that described above, the bank 
55 identifying header sequence, e.g., in the case of VISA 7 cards, the initial digit M" followed by the 5 digit BIN number 
is replaced with an equal number of random digits taken from the range of unused headers. This ensures that the 
resulting number does not represent some other valid existing credit eardnumber. These replacement header sequence 
digits can be ffaced for a ghren card issuer and can be reconstructed after decryption. 
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[OlOd] Th final checksum digit can b handled in one of several ways. For example, the checksum digrt can be 
recalculated based on the encrypted remainlhg digrts as described atwve. Altemativety, the final checksum digit can 
be omitted from the encryption process and recalculated after decryption, 

10110] The remaining digits can be refomiatted into another number with the same number of digits by any reversible 
encryption process. The same process may also be applied to all other numerical information transmitted that may be 
issued during a transaction, e.g., the expiry date and other codes. One process for randomizing these remaining digits 
is described above. Another process to encode the remaining digits is to perform a digit by digit mathematical operation 
in combination with a mask containing the same number of digits as the remaining digits to be encoded. 
(0111] For example, assume the original remaining digits are 878918982 and the random mask digits, containing 
the samer numb^ of digits as the remaining digits to be encoded^ are 143337658. A.modulo 10 arithmetic function is 
then perfonmed using the original remaining digits and the random mask digits as follows to achieve the encrypted result. 



Original remaining digits 


8 


7 


8 


9 


1 


8 


9 


8 


2 


Random mask digits. 


1 


4 


3 


3 


3 


7 


6 


5 


8 


Encrypted remaining digits 


9 


1 


1 


2 


4 


5 


5 


3 


0 



[01 12] After transmission of the encrypted card number, including the replacement header sequence digits, the en- 
crypted remaining digits and the checksum digit, if appropriate, the encrypted card number is separated out into its 
components. The encrypted remaining digits are decrypted in the opposite manner in which they were encrypted. 
Specifically, knowing the random mask digits and the encrypted remaining digits, a modulo 10 subtraction is performed 
to reconstruct the original remaining digits as follows. 



Encrypted remarnrng digits 


9 


1 


1 


2 


4 


5 


5 


3 


0 


Random mask digits 


1 


4 


3 


3 


3 


7 


6 


5 


8 


Original remaining digits 


8 


7 


8 


9 


1 


8 


9 


8 


2 



[0113] Even with this simple encryption technique, the decryption solution requires access to the private key because 
the solution cannot be identified in isolation. In addition, this process enables the reconstruction of one of the sequences, 
i.e., the original remaining digits, the random mask digits or the encrypted remaining digits, knowing the two other 
sequences. 

Fig. 6 is a flow chart iltustrating an exemplary process for electronically using credit card numbers. The software can 
be launched either on Its own or activated by an Icon integrated into an Internet browser. (Step 602). The software can 
provide a simple interface with a graphical appeanance that exploits familiar images of credit cards and/or ATM's. The 
software can be programmed using Java code or a Java core embedded in a cfc** application or equivalent program- 
ming language. 

[01 14] Once launched the user puts in one password to gain access to the main screen of a computer, which contains 
a keypad to alk>w a PIN to be inputted either by keyboard or by mouse clicks. {St^ 604). The latter protects against 
any covert attempts to record passwords by trapping key strokes. A consecutive number of en-ors in inputting the 
password will permanently disable the program and ovenAmte remaining encrypted numbers. After the correct PIN is 
entered, the user can select a new limited use number with or without additional constraints (e.g. maximal transaction 
value). (Step 606). A new limited use number is then displayed on the graphical interface. The software can provide 
secure access to encrypted credit card numbers that are stored on a computer's hard disk. (Step 608). These numbers 
can be accessed for use on the Internet or for use over the phone/mail order. (Step 610), The numbers must therefore 
be able to be inserted directly Into a web page (step 612), or printed out/copied from screen for use in other ways. 
(Step 614), The limited use number can be copied, printed, pasted via the clipboard (or equivalent) or dragged-and- 
dropped onto a web page. The length of time a number is displayed and how the program tenninates are user config- 
urable. The user can also record a comment to provide further information about how a number was to be applied. For 
automated transactions, the software should ideally be able to intercept and respond to merchant server initiated signals 
activating integrated functions within the browser. 

[Mist Once a number has been accessed, h can bedeleted from the encrypted lists. (Step 616). The date, number, 
current URL in the. case of Web use and any user comments are then stored by a. separate form of encryptfon to 
fadlitate audit/review. (Step 618). The user can review, but not edit this information 

[01 1 6] There should be a facility for downloading additional numbers either from additional floppies or via the Internet 

using high security protocols. (Step 620), The latter function can be performed by a separate program. 

[01 17] The program should include a maximal degree of transparent security features, i.e., features that do not affect 
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a normal user, but that protect against the program being retnstatted or copied onto a second machine. This means 
that the encrypted limited use numbers should either be stored within the executable file or stored in a file that also 
stores encrypted copies of the machine specific information. (Step 622). This is required to ensure that the numbers 
can only be accessed on the machine on which the software was first installed. The data files should also be stored 
5 as hidden system fifes. 

[01 1 8) Some u^rs may wish to have the equivalent of an electronic wallet that can be de*insta(led finom one computer 
and reinserted on another, for example, when transferring a Vallet" from an ofRce to a home machine. This transfer 
process ensures that only one version of the prxjgram is running at any one time and that no problems arise in terms 
of reconciling lists of used numbers. Appropriate security mechanisms can be implemented to identify the valid user. 

10 [01 19] Appropriate security measures include encryption. Encryption of limited use numbers should involve two levels 
as exemplified above.. At the first level, the card numbers are enaypted using an algorithm that ac^ only to alter the 
ttoe digits within the credit card. The header sequence (i.e., BIN number) is left unaltered or converted into an unused 
BfN number and the checksum recalculated. This prevents any form of brute decryption because there will be no way 
of telling when the correct algorithm has been selected since each number starts and ends up as a valid looking credit 

15 card number. Following this step each number is encrypted with industry standard encryption methods {e.g. RSA or 
OES). Following decryption within the program the checksum is recalculated for the final numt&r and the appropriate 
bin number reinserted. 

(01 20] The software can be shipped on a single 1 .4 Mb Ftoppy (or any other computer readable or usable medium) 
in an encrypted form or downloaded from a website. Limited use numbens can be issued either with the (>rogram or 

20 independently. An independently shipped password can be required for installatfon. The installation process will alfow 
the program to be installed a restricted number of times after which critical data is oven/written. The precise number of 
allowable installations wilt be easily alterable within the software design. Once installed on the host computer, the 
program encrypts internal information regarding the machine's configuration to protect against copying of the program 
onto other machines. At first installation the user can select his own passwords. These will be used to control both 

25 access to the programs and to rnffuence the pattern of one level of encryptron that is applied to Itmhed use numtiers, 
[0121] As numbers are accessed, a graphical Indicator of the remaining amount of limited use numbers provides 
early warning if additional numbers are required. The software can also provide a log of previously accessed numbers, 
the date, associated URL if activated from within a browser and comment; a summary of account expenditure; assist- 
ance with adding additional numbers from disk or via Internet; the ability to configure additional passwords/users for 

30 shared cards; and/or hot link Internet access to the card number issuerOs web site. 

2.6 Processing of card transactions 

[0122] It is envisioned that additional credit card numbers and/or additional credit cards would be processed by 
35 merchants in the same manner as existing credit card numbers and/or credit cards with the merchant obtaining vali- 
dation of the credit card number from the credit .card company or authorized third party. In much the same way as at 
pnssent. the additional o'edit card number would be matched to the customer account and the account would be debited 
accordingly. The merchant reimbursement following verification of an additional credit card transaction would be per- 
formed in the normal manner, A partk^lar advantage for the merchant is that since they are never In possession of 
^0 the master credit card number or indeed, in many instances, of the master credit card, they have no responsibility for 
security to the master credit card holder. It is envisaged that where there are additional credit cards used, it may not 
be preferable to take an imprint of the credit card manually, as the imprint can be taken electronically. Similarly, those 
processing the credit cards will process them in. the same manner described heretofore. 

[0123] Processing systems for handling limited use cards perform a number of functions including some or afl of the 
45 following: 

1) Verify that the limited use number is valid. 

2) Verify that the iransactbn falls within }imltat»ns placed on the specific number. 

50 

3) In the case of a limited use number associated with another account, verify that transaction falls within limits 
acceptable for the associated account. 

4) ProvkJe authorization to the merchant If valid and vwthin the limitations for specified number and associated 
55 account. 

5) Pennit later transactions to be charged to a limited use number that has been invalidated for further authoriza- 
tions only if the transaction is generated by the same merchant that obtained pre-authorization for the same trans- 
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action. 

6) Deny authorization if invalid or exceeding limitations on number or associated account. 
5 7) Activate fraud detection mechanisms if invalid number or on attempt to reuse an invalidated limited use number. 

8) Invalidate limited use number for further authorizations/payments if limitations on use are met or exceeded by 

a specific transaction. 

w 9) Mamtain Hst of invalidated numbers for reimbursement in the case of returned or faulty goods for a defined period. 

10) Limited use numbers and transaction details logged and liniced to associated account. 

11) Transmit records of limited use and other card transactions tothe user by post or e-mail. 

15 

12) Instate payment to merchant.for approved transactions. 

13) Instigate reimbursement to account holder in case of a refund. 

20 14) Invoice account holder for payment for charges ihcunred or arrange settlement via ar>other account. 

[0124] Many of the pnocedures associated with limited use cards represent functions already performed by the clear- 
ing systems. These existing functions include: adding new CTedWdebli card numbers to the processing daiabasBs; 
allowing these card numbers to be activated following a confirmatory call to the issuer by the customer; conferring a 
25 credit limit on a credit card number, and invalidating a credit card number from further use and marking any further 
use as fraudulent. This overlap represents part of the commercliar value of the single use invention, minimizing^ the 
required changes. 

[0125] Once a limited use number enters the clearing system it can be handled in a normal fashion, e.g., by ensuring 
that it has not been reported as being stolen and that it represents a valid account. number within the database, if the 
30 transaction is within the credit limit of the oistomer and the transaction limit or restricted use limitations of the limited 
use number, it Is authorized. 

[0126] Several specific modifications should be made to the processing software to implement the features of limited 
use cards. For instance, valid limited use numbers are stored in a database of valid account numbers along with other 
information specific to limited use numbers. This includes sufRcrent infonnation to identify the custonner to whom it was 
35 issued and any additional limitations placed upon the card in temns of transaction value or category of merchant for 
which (he card can be used. 

[0127] Once authorized, the limited use number is invalidated deactivated so as to ensure that further authorization/ 
charges cannot be made on that number. To allow for authorization preceding request for settlement by a substantial 
delay, for example in the context of a mail order purchase where a credit/debit card number may be authorized at the 

40 time of order and charged only when the product ships, delayed settlement to the same merchant must be allowed. 
[0128] Once the number of transactions permitted for a limited use card is reat^ed, the central card processing 
software invalidates the card. Due to the time delay that can occur between authorization and a merchant request for 
settlenf»ent, inrproved security is achieved by linidng the invalidation process to authorization. Linking invalidation to 
settlement facilitates pre-authorizations at the cost of increased risk of, for example, multiple use of a card numt>er 

*5 intended for limited use. Pre-authorizatlons can be used with authorization dependent invalidation as described above. 
In the case where a transaction is not authorized before being accepted by a merchant, the invalidation process will 
occur when the transaction details are transmitted to the processor for settlement. When no authorization is obtained 
for a limited use number the system will therefore stHI operate normally with an increased levels of risk for ttie issuer/ 
merchant as is the case with an unauthorized com^ntional card transaction. 

50 [01 29] Whenever the credit limit or vaPdity of a. customer's account changes, all currently valid limited use numbers 
are identified and their associated credit limit is altered to the lower of either their allocated transaction or the existing 
credit limit If the customer account is closed or declared delinquent, all valid single use numbers are handled in the 
same manner 

[0130] Whenever a limited use number Is used, the next available single use number previously allocated to the 
55 same customer and issued to the customer is added to the database of valid account numt)ers. 

[0131] When a transaction is charged to a limited use number, the transaction details and customer account details 
are stored together for audit purposes and the value of the transaction is added to the customer's account for billing, 
[0132] The software for storing transaction details and printing statements can be modified to allow for both the 
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customer's conventional account details and the limited use number transaction details to be reported. 
[0133] Processing of limitied use numbers can be integrate into existing systems in a variety of ways. The author- 
ization and settlement process can be completed in a single cyde or split into a separate authorization and settlement 
processes as is commonly done in existing credit card systems. 

(0134] In the case of an entirely new, stand-atone , limited use credit/debit/charge card processing system , the above 
functions can be implemented without restriction in any suitable computer capable of incorporating the required data- 
base and communication functions. Such a system should t>e able to provide an authorization fior a transaction within 
the same time scale as an existing credit/debit/charge card transaction. 

[0135] In the case where the above fun<^ions have to be integrated into existing systems several approaches can 
be taken to minlmcze the required changes. It is possible to add steps to the processing chain that is encountered as 
soon as a credit/debit/charge card number is received from a merchant 

[0136] Fig. 7 is a flow chart illustrating an exemplary process for processing a transaction. In step 702, a software 
system receives transaction details from a merchant. The software system determines whether the number is a limited 
use number or a conventional card number. (Step 704). If the number is a conventional card number, it is passed on 
unchanged into the processing system and can be handled by existing systems with no modification. (Step 706). The 
merdrant receives authorization from the system responsible for authorizing conventional card numbers. Merchant 
reimbursement is similarly unaffected. (Step 7081). 

[0137] The system can check the limited use number and the correspondmg Umitalions. (Step 710). H the number 
is not valid for the designated transaction, the transaction is denied. (Step 712). Otherwise, a database look-up pro- 
cedure determines the associated master account number and trar\smlts this number (i.e. the master account nunvber) 
back into the processing system. (Step 714), This allows aH existing fraud detection, authorization and demographic 
software procedures to be completed with no alteration. (Step 716). Once the master account number is substituted 
for the limited use number a number of additional steps are required. (Step 718). If the criteria for invalidating the limited 
use number have been met during this transaction, then the limited use number is invalidated for all future transactions 
except refunds. An additional limited use number can be automatically issued if a continual supply of single use numbers 
is required. The transaction details and master account number are then transmitted for inclusion within a database 
to allow for tracking of transaction details and billing of the user. These functions do not need to be performed before 
an authorization is Issued but can completed aftenvards. (Step 720). However, performing such steps together with 
the validity verification of the limited use number prior to issuing an authorization message to a merchant is a feasible 
optk>n with a minor reductk>n on the processing time required to issue an authorization message. 
[0138] With the above system, the software responsible for substituting the master account number for the limited 
use number can also process additional features unique to limited use numbers. These features include transaction 
value (Imitations, merchant type restrictions and geographical limitations. If the transaction exceeds the limitations 
placed on the limited use card then authorization is denied and the mastercredit card need not be passed on for further 
processing. In the case of a transaction falling within the limitations of a limited use card, then the transactron details 
are passed on with the master account number for conventional validation. In this way the restrictions in place for the 
master, account (e.g., available balance, expiry date) are checked for each limited use transaction. 
[0139] Specific fraud detection mechanisms can also be incorporated into the software. For example, on the first 
occasion that an Invalklated limited use number is used this transaction can be flagged as potentially fraudulent and 
appropriate measures taken. Repeated attempts to authorize invalid numbers from a single merchant or group of 
merchants also potentially points to fraud and can lead to activation of appfx)pr!ate fraud management measures. 
[0140] The above system requires the least modification of existing systems but may take up to twice the processing 
time of a conventk>nal transadton due to the double authorization process, once within the limited use verification and 
transtaUon step and once within the standard systems. It may be advantageous to initially process the limited use card 
as a master credit card by using a single list of limited use numbers and master credK card numbers. 
[0141] Fig. 8 is a flow chart illustrating another exemplary process for processing a transaction. In step 802, a software 
system receives transaction details from a merchant The software system has access to a database that contains 
additional information to identify the associated account or means of settlement and specific Hmrtations relating to the 
use of limited use cards. As a result, limited use numbers can be associated with existing accounts in the manner 
cun-entJy used to associate multiple conventional accounts in the case of multiple cards issued to a single company 
for corporate use. (Step 804). During an authorization the associated account number need not be identified provided 
each limited use account is updated whenever the status of the associated account changes (e.g. available balance, 
account \^lidity etc.). The system can deny authorization (step 806) or authorize a transaction (step 808) without 
identifying the associated account number. 

[0142] For settlement and billing purposes (step 812), the assodated account needs to be idenUfied (step 810), but 
this does not need to be done during the course of an authorizatwn. The existing software should be modified or linked 
to a new program that perfomns duties specific for limited use card numbers as described above. (Steps 814. 816. and 
81 8). These functions do not need to b performed before an authorization is issued. These functions can be completed 
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afterwards. 

[0143] this system requires more mcxllfication of the existing processing software systems, but offers authorization 
times wilhin the same timescale as existing transactions since only one authorization steps is involved. Other activities 
such as updating the limitations on the limited use card when the master account changes can be performed outside 
the authorization process (i.e., Aoff-tinea). 

[0144] Such other actMties can also take place whQe the system is operating. The system may indude some or all 
of the following features: 

1) A system capabie of altering the nature and value of limitations associated with a specific limited use credit/ 
debit/charge card number on the basis of the usage of that specific limited use card number in transactions, where 
such alteration is conducted while the system is operational; 

2) A system capable of altering the nature and value of limitations associated with a speciflG limited use credit/ 
debit/charge card number on the basis of instructions generating on behalf of the issuing bank, where such alter- 
ation is conducted while the system is operational; and 

3) A system capable of altering the nature and value of limitation associated with a specific limited use credit/debit/ 
charjge card number on the basis of instructions generated on behalf of the card holder, where such alteration is 
conducted while the system is operational. 

[0145] The invention is not limited to the embodiments hereinbefore described but may be varied in both construction 
and detail. For instance, the invention has been heretofore described mainly in the context of a system in which a 
customer receiving a single use card already has a main account with the credit card provider. But this need not be 
so.. For example, it is envisaged that an ATM machine (or similar apparatus) could be used by people who did not have 
a credit card account to purchase disposable credit cards, which disposable credit cards could then be used for either 
card present or remote transactions. When the card had been used, the card would be simply reinserted into the ATM 
machine, and after a suitable period of time the purchaser's account would be credited with any money not spent. 
Similariy, if the person who purchases the disposable credit card does not have an account of any sort with the credit 
card provkler. the credit card couki still be purchased from the ATM machine and then any refund could take place a 
sufRcfent time after the transaction would have been cleared, which refund could be either in the form of a cash refund 
to the purchaser or to a crediting of that purchaser account with another financial institution. Similarly, it v^riH be appre- 
ciated that the use of an ATM machine is not essential, as the disposable credit cards or single use credit cards could 
be purchased in the normal way in which one purchases any other goods or services, such as either directly in a face- 
tO'face transactk>n or by post 

[0146] Similarly, while in the above it has been suggested that there could be single use credit cards that would be 
purchased, there is no reason why they could not be multiple transaction aedit cards with an aggregate aedit limit. 
Further, these cards could, instead of bein^ credit cards, be simply credit card numbers for single or multiple use. It 
is. however, envisaged that for operational efficiency, these numbers are much more likely to be issued as disposable 
credit cards or single use credit cards. Thus, for those who do not wish to handle a credit card or whose credit worthiness 
is such that they wouW not be allowed to have a credit card, it will now be possible for them to have the use of a credit 
card. This would have considerable advantages for the credit card providers. 

2.7 Card hokJer controlled vafidity of CTedit card rmmbers 

[0147] In processing a transaction as described above, one step is to determine whether or not a limited use credit/ 
debit/charge card number is valid. As discussed above, when a new credit card is presently issued, it is commonly 
required that the card holder activate the card. Specifically, the card holder may be required to communicate with the 
credit card issuer to activate the card before rt can be used. Alternatively, in one embodiment of the present system, 
the card holder can control the activatwn or valkiity of a credit card number, or equivalent transaction code, during the 
course a transaction. Thus, in this embodiment, the card holder has the control, security and confidence that payments 
can only be made with his or her express permission. 

[0148] Fig. 9 is a flow chart illustrating an exemplary method of controlling the validity of a limited use credit card 
number. The card holder has a credit card number, or equivalent transaction code, that is allocated to the card holder, 
but is not yet active. (Step 902). The card holder can adcnowledge delivery of the credit card number, but the number 
remains inactive within the card issuer's processing system, e.g.. a bank's processing system. (Step 904). When the 
card holder wishes to conduct a transactran, he or she contacts the card issuer to activate the credit card number 
(Step 906). Activating the credit card number before every transaction Is cumbersome, but in the context of a remote 
transactton for example, via the Internet or equivalent networic. the communication between the card holder and the 
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card issuer can be achieved very rapidly by an entirely automated system that will activate the card during the process 
of conducting a transaction with an internet based merchant. The credit card number is activated for a specific trans- 
action only when specifically requested by the card holder. (Step 908). 

[0149] The properties of this validation or activation process can vary. For example, the validation could be for a 
5 specific time period, for a specific merchant or group of merchants, for a specific type of transaction, or for a specific 
number of transactions (authorizations and/or presentments). These properties can also be combined in any permu- 
tation. For example, a card holder could request that his or her credit card number be validated for one transaction 
with a specific merchant up to a specific value limit or value range (e.g.. a specific value +A a configurable range). In 
the event that no authorization is received wUhin a defined period, the validity can lapse. This combination provides a 
io solution that meets the need for a secure, flexible payment system for remote transactions. 

[0150] Moce spedficany, for internet transactions the card holder would receive a software paclcage from the card 
issuer along with a unique personat vaHdity limited credit card number. This software package would also facilitate 
completion of the merchants web page using ECML (electronic commerce modeling language) or some other equivalent 
electronic waflet system. Merchants wishing to use this system provide a unique n>erchant identification number on 
15 their web site. For merchants who are not compliant with such systems, a simpler automated method, e.g.. **drag and 
drop,' of transferring card rHJmt>er and other details is supported. 

[0151] When a card holder wants to conduct a transac^on, he or she activates the validity limited credit card software 
using a password or hardware based user identification system (e.g., magnetic stripe card reader, chip card reader, 
electronic token generator, fingerprint recognition system or the like) thereby identifying himself or herself with the card 

20 issuer The card holder then requests his or her credit card number to be validated for the merchant as identified by 
the merchant identificatron number. After use the card number is automatrcaily inactivated again. The card holder may 
also specify additional Kmltattons as discussed above, such as value limitations and maximum number of available 
transactions. Altemath^ely. these limitations could carry default limitations, for example single transactions up to a value 
of $100.00. This request would be transmitted via the Internet to the card issuer's card computer processing system. 

25 The processing system wouk5 validate the card holder's password (or hardware device), if appropriate, and forward 
the appropriate validity request to the card processing systems database. 

[0152] The card issuer's server may also verify the merchant's identity by providing confirmation of the merchant's 
name as it will appear on the card holder's credit card statement. This merchant verification helps to avoid .a common 
source of potential confusion for card holders in creditcard transactlons. The merchant identification number can either 

30 be the actual credit card systems merchant-ID or another unique code. In either case, the credit card merchant-ID that 
will be transmitted to the processing system during the transaction is entered into the processing system's database. 
This ensures that only the intended merchant can initiate a transaction with the validated credit card number. In the 
event that a merchant identification code does not satisfy the card holder's expectations, the card holder has the option 
to cancel the transaction before any information is passed to the merchant's web site. 

35 [0153] When appHcation of the one or mor& limitations are confimied, generally within a matter of seconds, the card 
hoWer is given verification of such and is aJIowed to transfer the credit card number and transactbn details to the 
merchant's web site. Since the merchant identification number is used to validate a specific number of transactions for 
that merchant, there is no benefit of a rogue or fraudulent merchant trying to steal the identity of another valid merchant. 
The transaction can only be reimbursed to the merchant identified to the card holder bythe card issuer's system. 

40 (0154J When a merchant receives the card holder's credit card number, the merchant processes this in an identical 
manner to an existing transaction in known systems. The transaction is passed through to the card issuer's processing 
system via the merchant acquiring and credit card networks. .At the carti issuer's processing system, the transacUon 
is handled by an authorization system that allows a card number to have associated validity restrictions or limitations, 
such as merchant-ID. If, in response to an authorization request, the authorization system indicates a valid card number, 

<s with an appropriate merchant-ID validation and sufficient funds, a normal authorization response is returned to the 
merchant. The number is then deactivated by the use triggered processing software within the authorization system 
or the in case of a multiple outstanding transactions the properties of the card number are updated to remove the 
pemnission for the authorized transaction (e.g. decrement the cumulated value limit). If the authorization system iden- 
tifies a problem with the request, for example, exceeding a limitation, the merchant is denied authorization. Transaction 

50 settlements and card holder billing proceed as described above. 

101 55] In the situation where a card holder is making multiple purchases with the same merchant within a short period 
of time, each validation by the card holder may be cumulative so that all the requested transactions can proceed. For 
example, if the card holder requests two transactksns. one of $50.00 and one of $ 1 00.00 dollars for a specific merchant, 
the credit card number wiU be validiated for two transactions to that merchant with a cumulative limit of $150. This 

55 means that both transactions will be authorized. In this case, the sequence of authorization requests from the meriihant 
may differ from original sequence of validation requests from the card holder. 

[0156] This system may be implemented using the Internet card software package, or RAD software package, as 
described herein. 
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[0157] tn general, the system provides a method for numbers and accounts to be set up and issued directly to the 
user. In addition, the system also permits users to directlyalter the properties of a credit card account within an issuer's 
authorization and settlement system. The set-up (issuance) and use of a limited use credit card number can take p\ace 
at the same time, i.e., in the same interaction or at separate times, i.e., setting up (issuing) a limited use credit card 
number at one timeand configuring the limited use credit card number at a later time. 

[0158] . This system has a number of advantages over existing credit card systems. Card fraud is greatly reduced 
since a stolen number requires the card holder to validate the card number before any transaction can be completed. 
This protects against either interception of the number during a transaction or the number being accessed from a 
merchanfs computer systems at a later date. In addition, if the number is authorized, the merchant is assured that the 
card issuer has directly validated that the card holder has requested the transaction. This prevents or limits a card 
holder's ability to repudiate the transaction. Moreover, the card holder has additional control on the purchasing power 
of his or her credit card . The card holder has the reassurance that payment can only be made to the merchant described 
by the card issuing bank/organization. 



2.8 Additional uses of the credit card numbers 



[0159] In situations where the card-holder and card issuer are in communication and authentication is required of 
one or both parties, the list of limited use card numbers held by each party can used as a fomn of identification. In the 
manner of a dynamic password ail or part of a single limited use number a sequence of such numbers could be used 
to identify either party without the need for issuing any additional security systems. Because this identification does 
not need to be handled by conventidnat transaction systems, all or part of a limited use number can be used for this 
purpose. 

101^0] Fig. 10 is a flowchart illustrating an exemplary process for using a credit card number as a PIN number. In 
step 1002, a card issuer generates a database of available credit card numbers. The card issuer selects a master 
credit card number or more genericaily master account number (step 1 004) and d istributes the master account number 
to a master account number owner. (Step 1006). The card issuer then allocates additional credit card numbers to the 
master account number (step 1 008), and distributes the additional credit numbers to the master account number owner. 
(Step 1010). When the master credit card number owner needs or desires to access account information (step 1012). 
the master account owner can use one of the additional credit card numbers as a PIN number. (Step 1014). 
[0161] As can be readily, seen, there are fundamental differences behveen the system of the present invention and 
any system that uses a PIN or other number (whether constant or varying from transaction to transaction) to validate 
a transaction. In the present system the numerical details conveyed in the course of a transaction are identical in format 
to an existing credit card number but no unique account code is included. This maximizes the security and privacy of 
a credit/debit/charge card transaction. Within the processing system the validity of the limited use number is verified 
first and then the assodatcKl account rdentified second by examining infonnatlon stored with the limited use number. 
With the transmission of an additional PIN or other number in addition to the account number or other unique identifier, 
there is a lower level of security and privacy. Within any form of PIN idemification (and as described by Rahman) the 
associated account is identified first and then the PIN verified after this step. For this reason many card holders can 
share the same PIN, indeed in most cases due to the short length of PIN codes many users do have identical PINs 
but different account numbers. For our system each limited use number must be unique at the time of use and so the 
associated account can be uniquely identified. 



2.9 System locations 



[0162] With reference back to Fig. 1 . and as described above, central processing system 100 can intemally perfomi 
the approval and denial of credit card ^nsactions or this function can be delegated to a separate clearance processing 
facility. In other words, central processing system can be located within the card ]ssuer=:s main processing system or 
at a stand-alone facility. In an exemplary embodiment of the present Invention, central processing system 100 adds 
additional functronafity to existing credH/charge/debit card systems without any. or with minimal, alterations. In general 
central processing system 100 transmits certain transaction details in a bidirectional manner, i.e.. utilizing dual inter^ 
faces between central processing system 100 and the merchant and between central processing system 100 and the 
card issuer, without revealing the master credit card number to the merchant. The dual interface transmissions, referred 
to herein as remapping, allow merchants and card issuers to handle transaction details in the same manner as con- 
ventional credn card transa<^ns. Such conventfonaf credit card transactions may be, for example, authorizations 
settlements, copy requests, and charge-backs. 

[0163] Remapping can be implemented by utilizing database look-up functions using existing industry-standard com- 
puter platfomis. In addiUon. remapping may occur by replacing the limited use card number with the master account 
number. 
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10164] Fig. 11 is a block diagram illustrating a credit card system 1100 in which a central processing system 1106 in 
accordance with an embodiment of the present invention is located within a card issuing bank's main processing system 
1114. The system 1100 includes merchant acquirers 1102 connected to card issuing bank's main processing system 
11 14 via a CTedit card network 1 1 04 and a switch 1116. The credit card network 1 1 04 may be any type of communication 

5 network, such as. the Internet, a radio network, etc. as described above. A switch 1116 includes hardware and software 
components. The switch 1116 may be configured to direct incomfng transaction details on the basis of the card number 
and to direct outgoing transaction details on the basis of the merchant acquirer identification number (referred to herein 
as the "merchant ID"). The issuing bank's main processing system 1114 inciudes an issuing bank processing facility 
1112 and a central processing system 1106. The centrarprocessing system 1106 includes an acquirer interface 1106 

10 and a STIP interface 1110 for exampJe. 

[0165] Exenfiplary transactions will now be described with reference to Figs. 11 and 12, Fig. 12 is a fkw chart itius- 
tra^ng an exemp\ary method of conducting a Hmited use credit card number transaction. A user initiates a transaction 
by presenting a limited use credit/charge/debit card number, either in person or remotely as discussed above. (Step 
1202). A merchant acquirer 1102 routes this limited use credit card number to the central processing system 1106 via 

IS the network 1104 and the switch 1116. (Step 1204). This routing is done on the basis of a specific bank identification 
number (refened to herein as "BIN") which is the first few digits of the limited use credit card number, as discussed 
above. In this example, the central processing system 1106 acts as a stand-in processor. 

10166] If the limited use credit card number is invalkil. or if the limited use condition has been satisfied, i.e., the 
condition has been met or exceeded, step 1206. the central processing system 1106 wift transmft a signa/ to merchant 

?o acquirer 1102 denying authorization of the card number via switch 1116 and ne^ork 1104. (Step 1208), If the limited 
use credit card number is valid, and if the limited use condition has not been satisfied, the central processing system 
1106 transmits a signal to the issuing processing facility 1112 via the merchant acquirer interface 1108 and the switch 
1116. (Step 1210). This signal includes the original transaction details but the card number and the merchant ID are 
remapped. This remapping provides the master credrt card BIN number so the signal will be routed to processing facility 

25 1112. This ensures that the aa^nzation can be obtained agamst the master credrt card and that any resulting author- 
ization, orjdenial thereof, is returned to central processing system 1116, as this appears to the processing facility 1112 
to be the merchant. (Steps 1212 and 1214). The authorization, or denial of authorization, is the remapped within the 
central processing system 11 06 to the original limited use credit card number and merchant ID. (Step 121 6). The central 
processing system 1106 then transmits a signal to the merchant 1102 authorizing the limited use credit card number, 

30 or denying authorization as appropriate, ak>ng. with the original transaction details via the switch 1116 and the network 
1104. (Step 1218). 

[01 67] Fig. 1 3 is a flow chart illustrating an exemplary method of conducting a settlement transaction, fn a settlement 
transaction, the merchant 1102 transmits a signal to the central processing system 1106 via the network 1104 and the 
switch 1116 according to the BIN of the limited use card number. (Step 1302). The central processing system 1106 

35 remaps the limited use credit card number with the master credit card or account number, the merchant ID with a 
central processing system ID and the merchant text descnption with a central processing text description (step 1304). 
andtransmits this remapped tnformatk^n to issuer processing facility 1112 via switch 1116. (Step 1306.) The processing 
fadfity 1112 settles the transaction by payment, if appropriate, to the central processing system 1106, (Step 1306). The 
central processing system 1106 then remaps the master credit card or account number back to the original limited use 

^ credit card number, the centra! processing !D back to the merchant ID and the central processing text description back 
to the merchant text description, (step 1310) and transmits this information along with the payment, if appropriate, to 
the merchant acquirer 1102 via the switch 1116 and the network 1104 (step 1312), As with the authorization cycle, this 
settlement cycle ensures that settlement is obtained against the master credit card; that the card holder's billing state* 
men! reflects the limited use transaction, with the central processing ID. and that the payment for settlement Is con- 

45 ducted through the central processing system 1106. 

[0168] If a card holder challenges or questions a specific charge on his or her billing statement, the copy request or 
charge back will be routed to the central processing system 1106. as this is the ID associated with the transaction. In 
a similar manner to that described above, the central processing system 1106 will remap the copy request or charge 
back according to the merchant ID and the limited use credit card number and transmit the copy request or the charge 

50 back to the merchant 1 1 02 via the switch 1116 and the network 1 1 04. The merchant 1 1 02 transmits the requested copy 
or the charge back confirmation to the central processing system 1106 via the network 1104 and the switch 1116 
according to the BIN of the limited use card number. The central processing system 1106 then remaps the ID and card 
number infonmation and fonA/ands the requested copy or charge back information to the processing facility 1112 via the 
switch 1116. 

55 [0169] The system 1 100 is advantageous in that it reduces communication delays and fees but it requires the addition 
of the switch 1116. Altemativety. Fig. 14 illustrates central processing system 1406 as a stand alone facility. The au- 
^oriza^on, settlement, copy request and charge back transactions described above are equally applicable to Fig. 14. 
except swrtch T116 in Fig. 11 is no longer required. Fig. 14 illustrates that communu^tion between central processing 
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system 1406 and card issuing bani<'s processing facility 1412 can be conducted through existing credit networks 1404. 
In addition to not requiring a switch, such as switch 1116, in this configuration, a single large central processing system 
1406 can offer limited use support to a wide range of issuers, such as bank processing facility 1412. However, this 
configuration requires increased communication times and potentially increased communication fees. 
5 [0170] In another exemplary embodiment, the central processing system could be constructed to be a part of the 
merchant acquirer, instead of the bank processing fadfity as shown in Fig. 11. This configuration would also require 
the addition of a switch like switch 111 6 but would reduce communication delays and fees. 

[0171] The limited use credit card number and remapping system may also be used in connection with organizations 
other than banks. For example, the limited use credit card number may be linked to organizations such as utilities, 
10 fntemet service providers, telephone accounts^ fixed or mobile, anonymous prepaid accounts and the like. With such 
o^er organizations, there would be no remapping to a master credit card number, but rather to some other account 
number provided by the organization. 

[0172] Linking a limited use credit card number to other organizations is advantageous for several reasons. First, 
the organization may have a pre-existing relationship with the user of the limited use credit card number. This relation- 
's ship provides evidence of the user's credit history with the organization, so no additional credit checks need to be 
performed, which can be costly and time-consuming for the organization. Second, because the organization is already 
providing other services to the user, a billing procedure is already established. The time and cost associated with 
establishing and implementing billing procedures has already been incurred. Minimal cost and effort is associated with 
adding a section to a billing statement for a limited use credit card number. 

20 

2.10. Remote access devices for accessing limited use numbers 

[0173] A card holder may desire to access a list of limited use credit/deblt/charge card numbers where the YtrDited 
use cards are not stored on the card holder's own computer. In the context of modern client server architecture this 

25 represents one extreme of the situatbn where all infomftation storage is at the server. The previous description for local 
storage indicates the situation of a client program with a significant amount of local functionality. Between these two 
extremes a range of Intermediary client server arrangements such as a "thin clienf with minimal functionality obtaining 
limited use numbers from the server as required. The combination of encryption and dynamic passwords, as described 
herein, or any suitable altematlve form of use identification allows a card holder to have "multiple wallets", i.e.. a card 

30 hokier can access limited use numbers, from different devices, without the need to transmit credit card numbers. 

[0174] As discussed at)ove. software and limited use numbers can be issued via electronic communication media. 
In one embodiment, a card holder can access limited use credit card numbers during electronic transactions via a 
Remote Access Device, referred to herein as "RAD", such as the Orbis Internet Card-d. Q The overall layout of the 
RAD system 1500 is shown in Figure 15 and a flow chart illustrating an exemplary method of providing remote access 

35 devices for accessing ITmhisd use credit card numbers is shown in Fig; 16. in general, the operation of the complete 
system from registration to completion of a transaction follows. 

[0175] When a user desires to register with RAD system 1500, the user submits user authentteation infomiation, the 
master account number and other identifying data for entry into a database 1502. (Step 1602). To register with RAD 
system 1500, the user must be a valkJ holder/user of the master credit card o r account number. (Step 1604). Once 

40 registered, step 1606, the user obtains a RAD 1504, step 1608. RAD 1504 includes a software package to which 
enables communication with a remote access device support server. refen*ed to herein as a RAD support server 1506, 
such as the Nexus User Support ServerQ to enabte the issuance of limited use card numbers. 
[0176] When the user initiates communicalran with RAD support server 1506. step 1610. RAD support server 1506 
first authentfcates the user, (Step 1612). If successfully authenticated, the user can then request a limited use number 

45 (step 1614) specifying any additional transaction limitations desired as discussed herein. (Step 1616) RAD support 
server 1506 issues a request over a networi^ to a central processing station 1508 for a limited use number with the 
one or more specified limitations. The limited use number provided in response to the request is associated with a 
specific RAD system user identification prevtousiy assigned to the user. 

[OtTT] The central processing station 1508 obtains the next available limited use number, (Step 1618). Once ob- 
50 tained, the limited use number.and the specified limitations, is entered into database 1502 such that the limited use 
number is associated with the user's infonnation already in database 1502. (Step 1620). The limited use number is 
then transmitted to the RAD support server 1506 for issuance to the user via RAD 1504. (Step 1622). RAD software 
package 1504 displays the limited use number. The user can transfer this limited use number to a web site for initiating 
a transaction. Transferring this number to a web site can be achieved by dragging and dropping the number onto the 
55 web page, by software-simulated key-stroke entry, by "one-click" methods, or by other suitable methods known to one 
skilled in the art. 

[0178] When a merchant 1510 receives a transaction utilizing a limited use number from RAD system 1506, the 
transaction details are handled in the same manner as an existing number since limited use card numbers share the 
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same format as existing credit card numbers. The transaction detaits are transferred to the merchant acquirer and then 
routed onto the appropriate issuer on the basts of the leading digits of the limited use number, i.e.. BIN, via central 
processing station 1508. The BIN is registered with central processing station 1508 to ensure appropriate routing. 
{0179] As described above, central processing station 1508 verifies the validity of the limited use number and ensures 
that the transaction meets all specified limitations. If the limited use number is valid and the transaction met the specific 
fimrtations, central processing station 1508 enters the master credit card number into the transaction message in place 
of the limited use number. Central processing station 1508 then transmits the transaction message to the issuer's 
processing facility 1512 as a normal authorization request. The issuer's processing facility 1512 transmits an author- 
ization tbrihe master card numt>er, if appropriate,-to central processing facility 1 508. Central processing facility remaps 
the master card number to the limited use number and the transaction message is transmitted to the originating mer- 
chant acquirer and then the merchant. Central processing station 1508 also updates the limitations and validity of the 
limited use number according to the details ofthe transaction. The limitation and validity updating is best done folbwing 
verification of available funds so that a limited use number with a cumulative value limit is only decremented in value 
if the transaction can be completed. If limitation and validity updating is done prior to checking for the availability/validity 
of the linked or principal account then certain updates will need to be reversed in the case of a decline on the linked 
or principal accounts This has a small computational overhead. If the authorization was approved by the issuer's 
processing facility 1512, the user's purchase can proceed as nonnal. If declined, a decline message is sent to the 
merchant. 

[0180] For settlements, the same routing occurs with all transactions deriving from a limited use number obtained 
from RAD system 1500. 

[01 81] The above described system will now be discussed in greater detail. 

[0182] The RAD system 1500 may be configured to provide the user with many features. The RAD system 1500 
enables the user to have multiple and different remote devices from which the user may access RAD support server 
1506. In addition, it enables a user to have multiple credit card accounts with one or more issuers and to select from 
amount these multiple accounts. The RAD sofhvare package 1504 enables users to have additional passwords asso- 
ciated with an account if desired. The additional passwords can be used, for example, for children and can have 
additional pre-defined limitations such as a low dollar transaction limits, e.g., $50.00, or merchant class restrictions, 
e.g., gas stations. 

[01 83] The RAD software package 1 504 includes a simple intuitive interface for the ease of the user, the appearance 
of which may be customizable without modification to the underlying code. The RAD 1504 may use images that relate 
to the front and back of a credit card to provide key areas of functionality. The back of the RAD 1504 includes an 
Interactive panel with a magnetic stripe for providing additional infomiation and/or advertising panels. The interactive 
panel/stripe area provides for password entry and functional selections. Upon activation, the front of RAD 1504 may 
be configured to provide additional functions, e.g., those required to initiate an on-line purchase. As discussed herein, 
supplying infomiation required for on-line purchases can be automated in a number of ways including "clicking and 
transferring" the information, "dragging and dropping" the information, or "one click shopping." 
[0184] In one embodiment, the RAD software package 1504 is configured to issue a sequence of paired numbers 
v^ich are securely issued and activated and/or decrypted by oral or written authorization, such as the communication 
of a password. These paired numbers inckide an identifier code and a mask code. In order to retrieve a limited use 
number, a user at a remote device identifies himself or herself using his or her a RAD software 1504 by transmitting 
the identifier code, such as a dynamic password to RAD support server 1506. The RAD support server 1 506 compares 
the Identifier code with the particular RAD software package 1504 and accepts, or validates, the identifier code if 
appropriate. If valkJ, RAD support server 1 506 detemiines the matching mask code for that identifier code fi-om database 
1502. The RAD support server 1506 uses the mask code to encrypt the limited use card number as described above 
and transmits this encrypted code to the user. The RAD software 1504 decrypts the encrypted code using the known 
mask code and reconstructs the initial digits, the BIN number and the checksum digit. The RAD software 1504 then 
arranges this information and reconstructs the limited use card number. 

[0185] The RAD support server 1506 is an Intemet based server that interfaces the RAD 1504 and the central 
processing statton 1508. The RAD support server 1506 receives requests for limited use numbers from users, validates 
each user. If appropriate, and supplies and validates limited use card numbers with specific limitations, as requested 
by each user, if appropriate. Such requests may be processed in any desired order, e.g.. first come first served basis. 
The RAD support server 1506 may also be configured to provide for location identification verification, secure delivery 
of limited use numbers, automated completion of payment fields in a merchant's web page order ft)rm, review of pre- 
VH3US transactions, access to additional issuer services and advertising. The RAD location identification verification is 
verifying the physical source ofthe request for a limited use number, e.g.. home, ofnce. ATM machine. This additional 
identification Is evidence to limit a user's ability to denya transaction. The RAD support server 1508 can be configured 
to require additional identification of the user if the RAD is being used from a physical source which is unknown to the 
RAO support server or which has not been previously associated with the RAD by the user. 
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[0186} To accomplish the above tasks, the RAD support server 1 506 should have a high bandwidth Internet connec- 
tion and highly secure firewalls to insulate critical information from undesired access. Communications between the 
RAD support server 1506 and the RAD 1504 is may be Internet based. Communication between the RAD support 
server 1506 and the central processing station 1508 and the database 1502 may be secured-via private networks for 

s additional security. In additk>n. to provide for additional security, the RAD support server 1 506, the central processing 
station 1508 and database 1502 may be tocated at the same physfcaf (ocatton, for exampte. the issuer's processing 
facility or some other facility whk^ meets the standards set for banking processing facilities. 
[0 1 87] Communication between the RAD 1 504 and the RAD support server 1 506 can use industry standard security 
protocols appropriate to the platform. For example, secure socket layer (SSL) encryption may be used in the case of 

^0 communication by a personal computer of the Internet. Alternatively, one of the encryption schemes described herein 
may be tmpiemented alone or in combination with password protection and/or smart card user authentication. Such 
communication security can be selectable by the issuer. For example, issuers can select what type of communication 
security they desire from a range of options. 

15 3. Controlled Payment Number (CRN) Applicatk>ns 

10188] As can be seen from the above, the described limited-use credit card numbers can be provided with user 
defined controls on how the numbers can be used. Hence, the phrase "controlled payment numbers" describes products 
which embody the invention described herein. 

20 [0189] To appreciate how a software and hardware platform embodying the invention can be used to generate a 
range of payment products that span the virtual, wireless and real worids it is necessary to consider the components 
of the complete platform and how these can be used in various combinations. To a large extent, remarkably distinct 
payment products can be derived using the existing platforms such as the RAD system 1500 of Fig. 15 in a range of 
configurations. Addition of standard additional components and interfaces further broadens the potential scope. The 

25 RAD system ^)atform 1500 has been des^ned from the outset to support such applications. This provides a rapid 
development path for new payment products since disvelopment requirements are limited primarily ta designing new 
client side components for configuring and controlling CRN payments. 
[01 90] At the heart of the CPN platform are a number of core components: 

30 » A card numl}er generating, and allocation system (e.g., support server 1 508) that allows for additional controls to 
allocated to the cards in a dynamic manner. 

• A card issuing process for distribution of CRN's to users that supports industry standard protocols, such as shown 
in Figs 5 and 6. 

• A card authorization and settlement process (e.g., Figs. 7 and 8) that provides addltranal verification and validation 
35 of cards against the current set of confrols that have been set up for that card. 

• A mechanism for relating a speciffc CPN to an existing credit card, debit card or general financial account (e.g.. 
Figs. 11. 12 and 13). 

[0191] The platfonm may be implemented with part as a personal computer connected to the Internet to provide 
^0 communication with the card issuer. The customer can set a range of limitations as determined by the issuer and the 
card number is issued in virtual form to the users computer (usually) for immediate use. 

[0192] This anrangement is ideal for e-commerce applications but, by altering how the core component functions are 
implemented and integrated, a range of additional applications can be produced. These applications can be broadly 
divided into: 

45 

1. Card present Transactions; 

2. MOTO (Mail Order and Telephone Order); and 

3. Wireless applications. 

50 [01 93] Specifically these applications can be implemented by varying: ( 1 ) the patterns of how the controls on specific 
numbers are combined. (2) the controls available to user(s), (3) who sets the controls and when, (4) how the controls 
are communicated to the processing system. (5) the communication device(s) or channels used to deliver an issued 
CPN to the user, (6) the iorm in which the CPN is Issued (virtual via software, voice generated, text message, paper 
receipt paper credit card card, plastic credit card), and (7) the fonm in whrch the CPN is presented to the merchant. 

55 [0194] The core transaction processing system for authorization and settlement is not aHered to any slgniffcant de> 
gree by any of these implementation variations. In addition most of the core back end systems for number generation, 
account generation, linkage to other accounts, customer servrce and maintenance remaiti unaltered. The architecture 
for issuing numbers to users supports a range of interfaces so the same architecture can support computer based, 
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phone, interactive TV or tntemal bank issuing for physical {mpfementations. The high degree of re-usat)llity of cone 
platfonm components is a key advantage in supporting the comnnercial vtabitlty of these other products. 
[0195] The following sections elaborate on these principles to indicate how in practical terms the system would op- 
erate and how a consumer would use the system in the various manifestations. 



3.1 Card Present Applications 



[0196] There are considerable opportunities to create new payment products by issuing fixed number plastic cards 
with flexibility and control provided by the present invention. There are applications of this approach in both the con- 
sumer and business markets. 

[0197] In these applications, new payment products can be created by placing "inteliigence" within the card process- 
ing system. A critical additional step is the creation of new communication channels between these processing systems 
and a card issuer/card holder. 

[0198] These communication channels which can include PC computer interfaces, PDA interfaces, mobile phone/ 
telephony interfaces, ATM interfaces. 

[0199] In combination with an issuer's capBb'^ity to configure specific card products, these add)tk>na} dynamic control 
features provide a niechanism for a traditional plastic payment card to be turned into a range of new products. In effect, 
the present invention creates "instantly configurable plastic payment cards". This capability can be combined with 
conventk>nal credit cards, debit cards and pre-paid cards. 



3. 1 . 1 Consumer Apptications 



[0200] There are range of consumer applications of which a few are iisted here. 



• TEEN CARD 

Given to a teenager, for example, this card has a pre-set limit transaction amount and/or must be spent at a 
partrcular merchant or merchants (or merchant type or types). A parent can receive feedback on card usage and 
change the spending power by computer interface or mobile phone at any time. This greatly enhances the control 
provided by exisfrng pre-paid teen cards. 

• GIFT CERTIf=ICATE CARD 

Given to someone to spend with a pre-set limit and can be limited to a particular merchant or merchant type. 
These merchants can be Visa or M/C compatible and protected by signature. 

• PRODUCT REBATES 

A limited use card couW be Issued with a product that has no value but can be activated by registering the 
product on-JIne for instance. The card is then loaded with the product rebate and can be used to purchase something 
on-line or at a retail store limited to the amount of the rebate. This will greatly reduce costs, to administer a rebate 
program associated wth e.g., issuing and mailing a check. 

• INSURANCE CARD 

A limited use card could te issued with an insurance policy or by a loss-adjuster at a visit following a claim. 
The company or the toss adjuster could provide instant card activation by contputer or mobile phone to allow the 
consumer to spend an amount appropriate to immBdiaie needs. 



3.1.2 Corporate Applications 

[0201] For corporate applications the controls Inherent in CPN technology together with the capability to support a 
range of communicatksn systems to set up controls for a specific account provide a powerfut business tool Examoles 
include: ^ 



COMPANY BONUS 

Given to employees as a bonus this limited use credit card number can be used anywhere Visa or M/C is 
accepted or allemaUvely limited to a particular merchant or merchant type. Cards can be issued and the company 
can set the reward amounts via a PC^omputer interface. All charges can be blHed to a central company account. 

COMPANY EXPENSE TRAVEL ACCOUNT 

This limited use card can be given to emptoyees for specific trips. The expense budget and types of expense 
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can be set by the emptoyer at \he start of the trip and the account deactivated until the next trip, 

• PURCHASING ACCOUNT WITH INTEGRATED PO REQUEST 

This limited use card can be given to employees company purchases and preconfigured for specific rules (e. 
5 g., nfiaximum single purchase amount and monthly expenditure). To extent these rules apply the employee can 

make a. request via a PC or mobile phone to the company purchasing system. If approved, the company system 
can automaticaHy extend the purchasing capability of the specific card and the employee receives a confinnation 
and purchase order number. 

10 3.1.3 Mail Order / Telephone Order (MOTO) 

(0202] The acceptabiMty of CPN*s at any VISA/Mastercard/Europay accepting merchant is a key advantage of CPN 
technology. This means that the existing computer based system can be for mail order and telephone order with any 
alterations. Having said that, the current system is not spedfrcally directed at MOTO users and users may not appreciate 
15 this capability. In addition many existing MOTO users may not have access to the Internet at the time of placing a 
MOTO order or indeed have Internet access at all. Without a credit card, telephone orders can be almost impossible. 
All the manifestations described below could also be provided linked to a bank account or pre-paid account. 
{0203] The folkMving represent specific products more specifically mar1<eted the MOTO maricet. As with the potential 
cross over between Internet and MOTO usage, these MOTO products could also be used in Internet applications. 

20 

3.1.4 Telephone interfaces for CPN delivery 

6 

[0204] Mobile telephony interfaces can allow both WAP (Web Access Protocol) and i-mode interaction with servers 
providing the CPN capabilities. This provides for authentication by password or PIN and delivery of a CPN via a simple 

25 interface for display on the screen. CPN*s can also be ^sued by SMS (Silicon Integrated Systems), which has the 
additional benefit of providing automatic storage of the number for later use. Review of statements is also possible via 
this interface. The core functionality for MOTO orders are very similar to Internet orders and so no major differences 
are required in terms of additional functionality, though the functionality is best limited in line with the small screens of 
cun-ent mobile telephones. This application would also be well suited to web-kiosk applications where users may not 

30" want to enter authentication credentials into public systems. There is currently increasing interest in "in-store" kiosks 
to provide additional product tines. This implementation of the web-kiosk is designed specifically for making purchases 
and the mobile CPN will ideally suit such a combined "clicks and mortar" transaction. 

[0205] This application, the mobile CPN, provides a suitable platform for MOTO or Internet payments. In this situation 
the mobile phone is used as a private and personal means of authenticating the user and delivering the number to the 
35 user. 

3.1.5 Alternative Web access devices 

[0206] It Is expected that web access will increasingly involve non-PC devices such as PDA's, set-top TV boxes. 
^0 Interactive TV and "smart" consumer devices. The CPN platform architecture provides for seamless integration of a 
wide range of web-access devices into a standard Orbiscom implementation. The CPN platform can be used with 
interactive TV, which provides for integration of the purchasing process with TV browsing". 

a 1.6 MOTO/ Web onfy Ptestic/Paper Card 

45 

[0207] Issuing a MOTO /Web only card vwth no embossed figures can be implemented within the CPN platform with 
the export of CPN's to a card production process. 

In combination with the CPN platform this approach has a number of advantages even though the number is fixed and 
used for a number of transactk>ns. 

50 

• Greatly reduced re-issue costs for compromised cards. This is especially true in a chip environment where card 
re-issue costs are greatly increased. Also it greatly reduces the inconvenience involved in re-issuing a card. 

• A physical card is useful when collecting tickets for example. 

• Additional controls from the Orbiscom platform provide for the flexible control of the overall limit. 

55 • Controls can be applied to create specific mail order merchant cards with incentives by applying merchant ID 
controls. 

• The CPN platform provides for stmpte fntegration into an existing credit feiciffty or account without the need to 
create a separate credit line. 



28 



EP 1 265 200 A1 



[0208] Controls can be set-up by an issuer or via a tetephone or computer interface as with other limited use credit 
card number products. These interfaces could provide for additional functions such as on-line statements. 

3. T.7 MOTO-oniy Account Number Distribution Options 

5 

{0209] In addition to the above card based solution, a system of distrifouttng numbers without cards coufd be incor- 
porated in the paper billing distribution system. This could involve printing an additional number{s) on a statement or 
other paper document as explained above. 

[0210] Customers could also be sent a new MOTO only number In the form of a stici^er that could be attached to an 
10 existing card, on expiry the number is simply removed. An alternative MOTO number could also be printed on the back 
of an existing credit card when a new card is issued. 

3.1.8 ATM Delivery of CPN numbers and or Cards 

^5 [0211] The ATM network provides an existing integrated network that provides: 

• user authentication 

• a configurable user interface 

• an interface to process customer requests 

20 • a screen and printing system to provide visual and printed infomiation for the 

• capability for delivering other physical materials (cash, statnps and potentially magnetic- stripe cards). 

[0212] This provides a means for providing CPN numbers or cards for a range of card-not present applications. This 
route is particularly suitable for people who do not possess a credit card but wish to purchase goods over the Internet, 
2S tetephone or marl order, 

3.1.9 Unique CPN transactions for MOTO 

[0213] The above physical manifestations of the Orbiscom platform for MOTO use a fixed number with variable 
^0 controls. It is also possible to issue a series of numbers on a single card or device that users use one at a time. A 
mechanism is required to ensure that user can simply keep track of numbers that have been used. A range of options 
are possible for including peel of labels where after use a CPN label is removed revealing an additional number un- 
derneath. AHematively scratch off cards like lottery cards could be used to ensure that a number is only revealed when 
a user wishes to use the card. 

35 

4. Wireless Card Present Applicatkjns 

[0214] CPN payments can be presented by developments in wireless and telephony applications most notably Blue- 
tooth and other emerging short range wireless technologies (e.g., Ultra Wide Band) and the advances in mobile phone 
^ capabilities. 

[021 5J The use of Bluetooth-enabled smart card readers communicating with POS (point of sale) tenminals, or mobile 
netwa-lc operators altowing users to buy products and pay for them on their bills. However, smart cards have not yet 
been widely deployed, and mobile networic operators do not have a track record in e-commerce payments. A better 
solution is offered by the present. invention, which utiJizes the existing credit card network. 
45 [0216] In operation, a Bluetooth enabled WAP phone, of instance, would be used to retrieve a CPN. The following 
steps would take place: 

1. The user would connect to the issuer's website using the WAP phone, and would log in and request a CPN. 

2. The issuer's web server would corrMnunteate with the Orbiscom server, which would issue an CPN with the 
50 required controls arid link to the users account (either set by the user at the time or using pre-determined default 

values). 

3. The CPN would be returned to the user's WAP phone over the mobile networi^. 

4. The user would instruct the Bluetooth-enabled WAP phone to discover the POS service of the POS terminal. 

5. The phone and POS terminal would establish a Bluetooth connection, using suitable authentication security. 
55 6. The phone would beam the CPN to the POS terminal. 
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Signature Authentication 

[0217] Card Present transactions are characterized by visual signature authentication, in which the signature on the 
credit card is compared to the signature on the sales voucher A different kind of authentication is required by wireless 
5 Card Present transactions. The unique SIM card in every' mobile phone can be used as an identification card, and 
technok>gies such as fingerprint identification and voice recognition wiH insure that a stofen phone cannot be used by 
anyone other than the owner. 

MobHePOS 

to 

{021 8] As welt as the familiar card present situations, such as payment at a restaurant, the g rowth of wireless mobile 
networks has made possible the development of mobile POS terminals. Up to now, mobile retailers and service pro- 
vkJers have been at a disadvantage as the worid moves towards a system of cashless transactions. Mobile POS 
terminals witt allow credit card payments on public transport, ^n taxis, and at open air markets, as well as allowing. It 
f 5 will also be possible to pay by aedit card for services such as pizza and grocery delivery, and appliance repair in the 
honne. Card preserit CPN applications will allow payment in all of these situations. 

Smart Cards 

20 [0219] As credit cards migrate to smart card technology, the payment possibilities will broaden. Smart cards are an 
ideal method of authenticating users with a card issuer during issuing of CPN numbers in a virtual environment. The 
transaction specific nature of CPN payments enables linkage of a smart card authentication step to a specific payment 
without requiring merchants or acquirers to impiement authenficatron technology. 

[0220] In addition several additional possibilities exist for storing CPN numbers in smart cards for card present use. 
25 For example, Ericsson*$ prototype Wireless Wallet is a real wallet that contains a smart card reader and a WAP server, 
and allows the user to browse the cards in the wallet from a WAP phone. CPNs could be stored on a smart card for 
use when needed. You could s'>mp)y browse the cards in the waJJet, and select the CPN to be sent to the POS terminal, 
all without taking the wallet from your pocket. 

30 3G Phones 

[0221] Third generation mobile phones and hand-held devices will be capable of requesting and storing CPN's, of 
displaying internet content much richer than the current WAP phones, and of running feature rrch applications such as 
the CPN system in accordance with the present invention. The march of technology will continue to create new oppor- 
35 tunities for card payments, and CPN technology will be there to provide the security needed. 

[0222] While the foregoing description makes reference to particular illustrative embodiments, these examples 
stiould not be construed as limitations. Not only can the Inventive system be modified for other card numbered systems; 
it can also be modified for other computer networks or numbering schemes. Thus, the present invention is not limited 
to the disclosed embodiments, but is to be accorded the wklest scope consistent with the claims below. 

40 

Claims 

1. In a Unandai transactkin system capable of usin^ at least one limited use credit card number whk:h is limited in 
^ use by a party other than a limited use credit card numl>er issuer and which is associated the master account 

number of a customer, a method of controlling the validity of the limited use credit card number comprising the 
steps of: 

sending to a user from a limited use credit card number Issuer a limited use credrt card number: 

50 

communicating with a limited use card number card issuer to establish limitations on the use of the limited use 
credit card number by a third party before it can be used in a transaction by said usen and 

authorizing transactions which meet said established limitations and den^ng other transactions by comparing 
55 at a central location the attempted use to the established limitations on use. 

2. The method of claim 1. wherein said use toftatfons indude a combination of a present transaction amount iimit 
and one of a merchant and merchant type. 
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3. The method of claim 2, wherein transactions are reported to a supervising authority other than a user at one of: a 
time of transaction and at a time of said supervising authority's initiation. 

4. The method of daim 1 . wherein said limited use credit card number is activated upon receipt by said third party 
5 provider of a limited use credit card number of commercially valuable ihfonmation from the user of said Hmrted use 

credit card number. 

5. The method of claim 1 , wherein said limited use credit card number is activated and limited to a predefined monetary 
amount as settlement of a ciain> by said user of said limited use credit card number against said third party that 

^0 provided said number to said user. 

6. The method of claim 1 , wherein said limited use credit card number is activated as a reward for activities of the 
user of said limited use credit card number. 

7. The method of claim 1 , wherein the limited use credit card number is activated when a user is traveling and is 
limited in use to travel related expenses, 

8. The method of claim 1 , wherein said limHattons on use are established by a supervising authority receiving a 
specific request for a specific use by a supervised user, ancf the limitations reflect thecontent of the^ecific request. 

20 

9. The method of claim 1, wherein said limited use credit card number is distributed using a Web Access Protocol 
enabled radio communication device. 

10. The method of clarm 1 . wherein said limited use credit card number is distributed via a non-PC web access enabled 
25 device. 

11. The method of claim 10» wherein said limited use credit card number is placed on a non-embossed card. 
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Fig. 3 
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Fig. 4 
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Fig. 5 
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Fig. 6 
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FIG. 13 
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